5.3
CVE-2021-26540
- EPSS 0.29%
- Veröffentlicht 08.02.2021 17:15:13
- Zuletzt bearbeitet 21.11.2024 05:56:26
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginApostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\\example.com".
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apostrophecms ≫ Sanitize-html SwPlatformnode.js Version < 2.3.2
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.29% | 0.493 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:N/I:P/A:N
|