apostrophe@2.102.4 vulnerabilities
The Apostrophe Content Management System.
latest version
4.10.0
latest non vulnerable version
first published
11 years ago
latest version published
24 days ago
licenses detected
- >=0
Direct Vulnerabilities
Known vulnerabilities in the apostrophe package. This does not include vulnerabilities belonging to this package’s dependencies.
How to fix?
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
apostrophe is a content management system (CMS) for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) which is triggered once the image module that an editor uploaded as SVG file which contains malicious JavaScript, is viewed. How to fix Cross-site Scripting (XSS)? Upgrade | >=2.63.0 <3.4.0 |
apostrophe is a content management system (CMS) for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerable to Insufficient Session Expiration which allows unauthenticated remote attackers to hijack recently logged-in users' sessions. Note: this only works if user switch locales after cutting. How to fix Insufficient Session Expiration? Upgrade | >=2.63.0 <3.4.0 |