Homepage

apostrophe@0.4.20

The Apostrophe Content Management System.

  • latest version

    4.28.1

  • latest non vulnerable version

    4.28.1

  • first published

    13 years ago

  • latest version published

    5 days ago

  • licenses detected

  • View apostrophe package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the apostrophe package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • C
    Authentication Bypass by Primary Weakness

    apostrophe is a content management system (CMS) for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS.

    Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness in the getBearer function of the authentication middleware. An attacker can gain unauthorized access to user accounts by using a password-only authenticated token to bypass additional authentication requirements.

    Note: This is only exploitable if the attacker knows valid user credentials but does not have access to the required TOTP or MFA code, and the deployment uses multi-factor authentication.

    How to fix Authentication Bypass by Primary Weakness?

    Upgrade apostrophe to version 4.28.0 or higher.

    <4.28.0
    • H
    Denial of Service (DoS)

    apostrophe is a content management system (CMS) for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS.

    Affected versions of this package are vulnerable to Denial of Service (DoS). The apostrophe-jobs module sets a callback for incoming jobs and doesn't clear it regardless of its status. This causes the server to accumulate callbacks, allowing an attacker to start a large number of jobs and exhaust system memory.

    How to fix Denial of Service (DoS)?

    Upgrade apostrophe to version 2.97.1 or higher.

    <2.97.1
    • M
    Open Redirect

    apostrophe is a content management system (CMS) for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS.

    Affected versions of this package are vulnerable to Open Redirect. It was possible to convince Apostrophe to redirect to a third-party website by appending an escaped URL with a trailing / added at the end.

    How to fix Open Redirect?

    Upgrade apostrophe to version 2.92.0 or higher.

    <2.92.0
    Go back to all versions of this package