Description
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires or is removed. A user with export permission must first create the archive, and sites with exports disabled, private upload storage, or authenticated upload delivery are not exposed through this network-download path. This issue is fixed in version 3.7.1.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
apostrophecms apostrophe
< 4.34.0affected
@apostrophecms import-export
< 3.7.1affected
References
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-5gc8-frw3-3vqm ↗
- https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498 ↗
- https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea ↗
- https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1 ↗