apostrophe 2.225.0-alpha vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the apostrophe package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
C Authentication Bypass by Primary Weakness apostrophe is a content management system (CMS) for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness in the `getBearer` function of the authentication middleware. An attacker can gain unauthorized access to user accounts by using a password-only authenticated token to bypass additional authentication requirements. Note: This is only exploitable if the attacker knows valid user credentials but does not have access to the required TOTP or MFA code, and the deployment uses multi-factor authentication. How to fix Authentication Bypass by Primary Weakness? Upgrade `apostrophe` to version 4.28.0 or higher.	<4.28.0
M Cross-site Scripting (XSS) apostrophe is a content management system (CMS) for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) which is triggered once the image module that an editor uploaded as SVG file which contains malicious JavaScript, is viewed. How to fix Cross-site Scripting (XSS)? Upgrade `apostrophe` to version 3.4.0 or higher.	>=2.63.0 <3.4.0
H Insufficient Session Expiration apostrophe is a content management system (CMS) for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerable to Insufficient Session Expiration which allows unauthenticated remote attackers to hijack recently logged-in users' sessions. Note: this only works if user switch locales after cutting. How to fix Insufficient Session Expiration? Upgrade `apostrophe` to version 3.4.0 or higher.	>=2.63.0 <3.4.0

Vulnerability

Vulnerable Version

Authentication Bypass by Primary Weakness

apostrophe is a content management system (CMS) for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS.

Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness in the getBearer function of the authentication middleware. An attacker can gain unauthorized access to user accounts by using a password-only authenticated token to bypass additional authentication requirements.

Note: This is only exploitable if the attacker knows valid user credentials but does not have access to the required TOTP or MFA code, and the deployment uses multi-factor authentication.

How to fix Authentication Bypass by Primary Weakness?

Upgrade apostrophe to version 4.28.0 or higher.

<4.28.0

Cross-site Scripting (XSS)

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) which is triggered once the image module that an editor uploaded as SVG file which contains malicious JavaScript, is viewed.

How to fix Cross-site Scripting (XSS)?

Upgrade apostrophe to version 3.4.0 or higher.

>=2.63.0 <3.4.0

Insufficient Session Expiration

Affected versions of this package are vulnerable to Insufficient Session Expiration which allows unauthenticated remote attackers to hijack recently logged-in users' sessions.

Note: this only works if user switch locales after cutting.

How to fix Insufficient Session Expiration?

Upgrade apostrophe to version 3.4.0 or higher.

>=2.63.0 <3.4.0

apostrophe@2.225.0-alpha vulnerabilities

The Apostrophe Content Management System.

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically