PT-2021-16902 · Unknown · Apostrophe Cms

Daniel Elkabes · Published 2021-11-07 · Updated 2021-11-10 · CVE-2021-25978

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apostrophe CMS versions 2.63.0 through 3.3.1

Description The issue allows for Stored XSS attacks when an editor uploads an SVG file containing malicious JavaScript to the Images module. This triggers the XSS once the uploaded file is viewed.

Recommendations For Apostrophe CMS versions 2.63.0 through 3.3.1, consider restricting the upload of SVG files to the Images module until a fix is available. As a temporary workaround, avoid using the Images module for viewing uploaded SVG files.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-25978

GHSA-4R9C-JGHC-CX5M

Affected Products

Apostrophe Cms

References · 5

• https://github.com/apostrophecms/apostrophe/commit/c8b94ee9c79468f1ce28e31966cb0e0839165e59 · Patch
• https://osv.dev/vulnerability/CVE-2021-25978 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4r9c-jghc-cx5m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25978 · Security Note
• https://github.com/apostrophecms/apostrophe · Note