GHSA-vmg4-6gfg-83qx
ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | apostrophe | < 4.32.1 | 4.32.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
The vulnerability is a single-request persistent DoS by submitting e.g.
"PATCH /api/v1/article/<id>" with a valid editor session and body of
{"toString.call":"x"}, overwriting the global toString function with
value x.
Fabian
References
External links from the advisory. They lead to third-party sites.