GHSA-9j9m-8wjc-ff96
Apostrophe CMS Insufficient Session Expiration vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | apostrophe | >= 2.63.0, < 3.4.0 | 3.4.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
Apostrophe CMS versions between 2.63.0 to 3.3.1 affected by an insufficient session expiration vulnerability, which allows unauthenticated remote attackers to hijack recently logged-in users' sessions. As a mitigation for older releases the user account in question can be archived (3.x) or moved to the trash (2.x and earlier) which does disable the existing session.
References
External links from the advisory. They lead to third-party sites.