Description
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, duplicate-import continuation accepts client-controlled replacement choices without binding them to a user-owned server-side analysis or authorizing the canonical target. On an import-enabled localized type, a contributor with draft editing authority can cross the publication boundary by selecting a published document for replacement, although the current assessment is based on remediation review rather than a repeated end-to-end reproduction. This issue is fixed in version 3.7.1.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
apostrophecms apostrophe
< 4.34.0affected
@apostrophecms mport-export
< 3.7.1affected
References
- https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-jf5h-36mg-rp6x ↗
- https://github.com/apostrophecms/apostrophe/commit/06e4b377f3c360f9e89c32dccd7e505ad5ddf498 ↗
- https://github.com/apostrophecms/apostrophe/commit/40b989b1a9dd23d30029b8ce7668634265cfe5ea ↗
- https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/import-export@3.7.1 ↗