Insufficient Session Expiration Affecting apostrophe package, versions >=2.63.0 <3.4.0
Threat Intelligence
EPSS
0.46% (76th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-APOSTROPHE-1912882
- published 8 Nov 2021
- disclosed 8 Nov 2021
- credit Unknown
Introduced: 8 Nov 2021
CVE-2021-25979 Open this link in a new tabHow to fix?
Upgrade apostrophe to version 3.4.0 or higher.
Overview
apostrophe is a content management system (CMS) for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS.
Affected versions of this package are vulnerable to Insufficient Session Expiration which allows unauthenticated remote attackers to hijack recently logged-in users' sessions.
Note: this only works if user switch locales after cutting.
References
CVSS Scores
version 3.1