CVE-2024-21501

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-21501
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.

5.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf Exploit Third Party Advisory
https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf Exploit Third Party Advisory
https://github.com/apostrophecms/apostrophe/discussions/4436 Issue Tracking
https://github.com/apostrophecms/apostrophe/discussions/4436 Issue Tracking
https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4 Patch
https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4 Patch
https://github.com/apostrophecms/sanitize-html/pull/650 Patch
https://github.com/apostrophecms/sanitize-html/pull/650 Patch
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S/ Mailing List
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557 Exploit Third Party Advisory
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557 Exploit Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334 Exploit Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apostrophecms:sanitize-html:*:*:*:*:*:node.js:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
History

25 Apr 2025, 19:37

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
CPE cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
cpe:2.3:a:apostrophecms:sanitize-html:*:*:*:*:*:node.js:*:*
References () https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557 - () https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557 - Exploit, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7/ - Mailing List
References () https://github.com/apostrophecms/sanitize-html/pull/650 - () https://github.com/apostrophecms/sanitize-html/pull/650 - Patch
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S/ - Mailing List
References () https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4 - () https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4 - Patch
References () https://github.com/apostrophecms/apostrophe/discussions/4436 - () https://github.com/apostrophecms/apostrophe/discussions/4436 - Issue Tracking
References () https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf - () https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf - Exploit, Third Party Advisory
References () https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334 - () https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334 - Exploit, Third Party Advisory
First Time Apostrophecms
Fedoraproject
Fedoraproject fedora
Apostrophecms sanitize-html

10 Jun 2024, 18:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7/ -

10 Jun 2024, 17:16

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S/ -

06 Mar 2024, 14:15

Type Values Removed Values Added
References
  • () https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557 -

24 Feb 2024, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-24 05:15

Updated : 2025-04-25 19:37

NVD link : CVE-2024-21501

Mitre link : CVE-2024-21501

JSON object : View

Products Affected

apostrophecms

  • sanitize-html

fedoraproject

  • fedora
CWE

No CWE.