Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWg5N2ctNG14Ny01cDJw

Open Redirect in apostrophe

Versions of apostrophe prior to 2.92.0 are vulnerable to Open Redirect. The package redirected requests to third-party websites if escaped URLs followed by a trailing / were appended at the end.

Recommendation

Update to version 2.92.0 or later.

Permalink: https://github.com/advisories/GHSA-h97g-4mx7-5p2p
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWg5N2ctNG14Ny01cDJw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 3 years ago
Updated: 9 months ago

Identifiers: GHSA-h97g-4mx7-5p2p
References:

• https://github.com/apostrophecms/apostrophe/commit/1eba144bb82bd43dab72ce36cfbd593361b6d9b7
• https://snyk.io/vuln/SNYK-JS-APOSTROPHE-451089
• https://www.npmjs.com/advisories/1029
• https://github.com/advisories/GHSA-h97g-4mx7-5p2p

Affected Packages