What is GHSA-4r9c-jghc-cx5m?

GHSA-4r9c-jghc-cx5m is a security advisory published by GitHub Security Advisories with Medium severity. Cross-site Scripting in apostrophe

Which CVE IDs does GHSA-4r9c-jghc-cx5m cover?

GHSA-4r9c-jghc-cx5m covers the following CVE IDs: CVE-2021-25978. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4r9c-jghc-cx5m?

GHSA-4r9c-jghc-cx5m has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-4r9c-jghc-cx5m?

GHSA-4r9c-jghc-cx5m affects 1 product, including: npm/apostrophe:\u003e= 2.63.0, \u003c 3.4.0.

GHSA-4r9c-jghc-cx5mMediumCVSS 5.4

Cross-site Scripting in apostrophe

Vendor

GitHub Security Advisories

Published

November 10, 2021

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-25978 →

📋 Description

Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed.

🎯 Affected products1

npm/apostrophe:>= 2.63.0, < 3.4.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2021-25978
https://github.com/apostrophecms/apostrophe/commit/c8b94ee9c79468f1ce28e31966cb0e0839165e59
https://github.com/advisories/GHSA-4r9c-jghc-cx5m