GHSA-9j9m-8wjc-ff96 CVE-2021-25979
Apostrophe CMS Insufficient Session Expiration vulnerability
- Severity
- 9.8 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 1.14%
- Chance of exploitation in the next 30 days. Higher than 66.62% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-613 Insufficient Session Expiration
- Fix
3.4.0- Upgrade apostrophe to this version or later
Description
Apostrophe CMS versions between 2.63.0 to 3.3.1 affected by an insufficient session expiration vulnerability, which allows unauthenticated remote attackers to hijack recently logged-in users' sessions. As a mitigation for older releases the user account in question can be archived (3.x) or moved to the trash (2.x and earlier) which does disable the existing session.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| apostrophe | >= 2.63.0, < 3.4.0 |
3.4.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
apostrophe npm → 3.4.0
- npm
npm install apostrophe@3.4.0- yarn
yarn add apostrophe@3.4.0- pnpm
pnpm add apostrophe@3.4.0
Severity breakdown
CVSS 3.1 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-613: Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
How to prevent it
- Implementation: Set sessions/credentials expiration date.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-86wm-68pq-5jwq ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export | High | Also affects apostrophe |
| GHSA-653j-g8j7-gh54 ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing | Medium | Also affects apostrophe |
| GHSA-vwwx-px9w-crrc ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints | Low | Also affects apostrophe |
| GHSA-vmxh-77cw-65j7 ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers | Medium | Also affects apostrophe |
| GHSA-m2m5-rw3w-cwmj ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users | Medium | Also affects apostrophe |
| GHSA-gqh3-7856-rjjg ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure) | Medium | Also affects apostrophe |
| GHSA-hhvr-8m24-qqr3 ApostropheCMS: Cross-domain session token in URL confers session takeover | Medium | Also affects apostrophe |
| GHSA-j5rq-xfvr-p969 ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service | High | Also affects apostrophe |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor