{"id":"CVE-2021-25978","state":"PUBLISHED","title":"Apostrophe - XSS","description":"Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed.","publishedAt":"2021-11-07T17:15:10.000Z","updatedAt":"2025-04-30T15:52:43.284Z","severity":{"score":5.4,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","source":"Mend"},"assigner":"Mend","products":["Apostrophe  Apostrophe "],"affected":[{"vendor":"Apostrophe ","product":"Apostrophe ","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"3.3.1","versionType":"custom"},{"version":"2.63.0","status":"affected","lessThan":"unspecified","versionType":"custom"}]}],"references":["https://github.com/apostrophecms/apostrophe/commit/c8b94ee9c79468f1ce28e31966cb0e0839165e59"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T19:48:10.461Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/25xxx/CVE-2021-25978.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-25978","state":"PUBLISHED","datePublished":"2021-11-07T17:15:10.000Z","dateUpdated":"2025-04-30T15:52:43.284Z","assignerShortName":"Mend","assignerOrgId":"478c68dd-22c1-4a41-97cd-654224dfacff","dateReserved":"2021-01-22T00:00:00.000Z"},"containers":{"cna":{"title":"Apostrophe - XSS","descriptions":[{"lang":"en","value":"Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed."}],"affected":[{"vendor":"Apostrophe ","product":"Apostrophe ","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"3.3.1","versionType":"custom"},{"version":"2.63.0","status":"affected","lessThan":"unspecified","versionType":"custom"}]}],"references":[{"url":"https://github.com/apostrophecms/apostrophe/commit/c8b94ee9c79468f1ce28e31966cb0e0839165e59","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Cross-site Scripting (XSS)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Mend","dateUpdated":"2021-11-07T17:15:10.000Z","orgId":"478c68dd-22c1-4a41-97cd-654224dfacff"},"credits":[{"lang":"en","value":"Daniel Elkabes"}],"solutions":[{"lang":"en","value":"Upgrade to version 3.4.0"}],"source":{"advisory":"https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25978","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.0.9"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"vulnerabilitylab@whitesourcesoftware.com","ID":"CVE-2021-25978","STATE":"PUBLIC","TITLE":"Apostrophe - XSS"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Apostrophe ","version":{"version_data":[{"version_affected":"<=","version_value":"3.3.1"},{"version_affected":">=","version_value":"2.63.0"}]}}]},"vendor_name":"Apostrophe "}]}},"credit":[{"lang":"eng","value":"Daniel Elkabes"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-79 Cross-site Scripting (XSS)"}]}]},"references":{"reference_data":[{"name":"https://github.com/apostrophecms/apostrophe/commit/c8b94ee9c79468f1ce28e31966cb0e0839165e59","refsource":"MISC","url":"https://github.com/apostrophecms/apostrophe/commit/c8b94ee9c79468f1ce28e31966cb0e0839165e59"}]},"solution":[{"lang":"en","value":"Upgrade to version 3.4.0"}],"source":{"advisory":"https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25978","discovery":"EXTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://github.com/apostrophecms/apostrophe/commit/c8b94ee9c79468f1ce28e31966cb0e0839165e59","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T20:19:19.357Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-04-30T15:48:54.843310Z","id":"CVE-2021-25978","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-30T15:52:43.284Z"}}]}}}