PT-2021-16902
CVE-2021-25978
·
Published
2021-11-07
·
Updated
2021-11-10
Description by
CVSS 3.1
5.4
MediumMetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Apostrophe CMS versions 2.63.0 through 3.3.1
Description
The issue allows for Stored XSS attacks when an editor uploads an SVG file containing malicious JavaScript to the Images module. This triggers the XSS once the uploaded file is viewed.
Recommendations
For Apostrophe CMS versions 2.63.0 through 3.3.1, consider restricting the upload of SVG files to the Images module until a fix is available. As a temporary workaround, avoid using the Images module for viewing uploaded SVG files.
Found an issue in the description? Have something to add? Feel free to write us 👾