CVE-2024-21501

Katalog CVE

CVSS 5.3 · Medium EPSS 1,0%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada apostrophecms sanitize-html, fedoraproject fedora. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.

Rincian

Terbit di NVD

24 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4 patch
• https://github.com/apostrophecms/sanitize-html/pull/650 patch
• https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf exploit · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557 exploit · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334 exploit · advisory pihak ketiga
• https://github.com/apostrophecms/apostrophe/discussions/4436 issue tracking
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA... mailing list
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ... mailing list