CVE-2024-21501
Medium
Description
Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
SeverityMedium
CVSS5.3
Exploit probability—
Product
Apostrophecms Sanitize-html
PublishedFeb 24, 2024
First seenFeb 24, 2024
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- apostrophecms sanitize-html2.12.1 or later
- sanitize-html2.12.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apostrophecms sanitize-html | v < 2.12.1 | 2.12.1 |
| fedoraproject fedora | 39, 40 | — |
| sanitize-htmlnpm | v < 2.12.1 | 2.12.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.