GHSA-rm97-x556-q36h
sanitize-html Information Exposure vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2024-21501
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
Affected packages
| Package | Versions |
|---|---|
| npm · sanitize-html | introduced 0, fixed 2.12.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-21501 ADVISORY
- https://github.com/apostrophecms/sanitize-html/pull/650 WEB
- https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4 WEB
- https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf WEB
- https://github.com/apostrophecms/apostrophe/discussions/4436 WEB
- https://github.com/apostrophecms/sanitize-html PACKAGE
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7 WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S WEB
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557 WEB
- https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |