CVE-2024-21501

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-21501

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

V

ersions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.

References
Link Resource
https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf Exploit Third Party Advisory
https://github.com/apostrophecms/apostrophe/discussions/4436 Issue Tracking
https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4 Patch
https://github.com/apostrophecms/sanitize-html/pull/650 Patch
https://lists.fedoraproject.org/archives/list/[email protected]/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S/ Mailing List
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557 Exploit Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334 Exploit Third Party Advisory
https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf Exploit Third Party Advisory
https://github.com/apostrophecms/apostrophe/discussions/4436 Issue Tracking
https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4 Patch
https://github.com/apostrophecms/sanitize-html/pull/650 Patch
https://lists.fedoraproject.org/archives/list/[email protected]/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S/ Mailing List
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557 Exploit Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apostrophecms:sanitize-html:*:*:*:*:*:node.js:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
History

25 Apr 2025, 19:37

Type Values Removed Values Added
First Time Apostrophecms sanitize-html
Fedoraproject fedora
Fedoraproject
Apostrophecms
References () https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf - () https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf - Exploit, Third Party Advisory
References () https://github.com/apostrophecms/apostrophe/discussions/4436 - () https://github.com/apostrophecms/apostrophe/discussions/4436 - Issue Tracking
References () https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4 - () https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4 - Patch
References () https://github.com/apostrophecms/sanitize-html/pull/650 - () https://github.com/apostrophecms/sanitize-html/pull/650 - Patch
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7/ - () https://lists.fedoraproject.org/archives/list/[email protected]/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7/ - Mailing List
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S/ - () https://lists.fedoraproject.org/archives/list/[email protected]/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S/ - Mailing List
References () https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557 - () https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557 - Exploit, Third Party Advisory
References () https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334 - () https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334 - Exploit, Third Party Advisory
CPE cpe:2.3:a:apostrophecms:sanitize-html:*:*:*:*:*:node.js:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*

21 Nov 2024, 08:54

Type Values Removed Values Added
References () https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf - () https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf -
References () https://github.com/apostrophecms/apostrophe/discussions/4436 - () https://github.com/apostrophecms/apostrophe/discussions/4436 -
References () https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4 - () https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4 -
References () https://github.com/apostrophecms/sanitize-html/pull/650 - () https://github.com/apostrophecms/sanitize-html/pull/650 -
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7/ - () https://lists.fedoraproject.org/archives/list/[email protected]/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7/ -
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S/ - () https://lists.fedoraproject.org/archives/list/[email protected]/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S/ -
References () https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557 - () https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557 -
References () https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334 - () https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334 -

28 Aug 2024, 18:35

Type Values Removed Values Added
CWE CWE-538

10 Jun 2024, 18:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/[email protected]/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7/ -
  • () https://lists.fedoraproject.org/archives/list/[email protected]/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S/ -
Information

Published : 2024-02-24 05:15

Updated : 2025-04-25 19:37

NVD link : CVE-2024-21501

Mitre link : CVE-2024-21501

CVE.ORG link : CVE-2024-21501

JSON object : View

Products Affected

fedoraproject

apostrophecms

CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-538

Insertion of Sensitive Information into Externally-Accessible File or Directory