PT-2021-16902
CVE-2021-25978
·
تاريخ النشر
2021-11-07
·
تاريخ التحديث
2021-11-10
الوصف من
CVSS 3.1
5.4
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Apostrophe CMS versions 2.63.0 through 3.3.1
Description
The issue allows for Stored XSS attacks when an editor uploads an SVG file containing malicious JavaScript to the Images module. This triggers the XSS once the uploaded file is viewed.
Recommendations
For Apostrophe CMS versions 2.63.0 through 3.3.1, consider restricting the upload of SVG files to the Images module until a fix is available. As a temporary workaround, avoid using the Images module for viewing uploaded SVG files.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾