Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:npm/apostrophe@0.4.10
Typenpm
Namespace
Nameapostrophe
Version0.4.10
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version2.97.1
Latest_non_vulnerable_version4.29.0
Affected_by_vulnerabilities
0
url VCID-5v79-remg-7ub4
vulnerability_id VCID-5v79-remg-7ub4
summary 
Denial of Service in apostrophe
Versions of `apostrophe` prior to 2.97.1 are vulnerable to Denial of Service. The `apostrophe-jobs` module sets a callback for incoming jobs and doesn't clear it regardless of its status. This causes the server to accumulate callbacks, allowing an attacker to start a large number of jobs and exhaust system memory.


## Recommendation

Upgrade to version 2.97.1 or later.
references
0
reference_url https://www.npmjs.com/advisories/1183
reference_id
reference_type
scores
0
value LOW
scoring_system generic_textual
scoring_elements
url https://www.npmjs.com/advisories/1183
1
reference_url https://github.com/advisories/GHSA-pv6r-vchh-cxg9
reference_id GHSA-pv6r-vchh-cxg9
reference_type
scores
url https://github.com/advisories/GHSA-pv6r-vchh-cxg9
fixed_packages
0
url pkg:npm/apostrophe@2.97.1
purl pkg:npm/apostrophe@2.97.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/apostrophe@2.97.1
aliases GHSA-pv6r-vchh-cxg9, GMS-2020-705
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-5v79-remg-7ub4
1
url VCID-pvxq-3qsf-efc5
vulnerability_id VCID-pvxq-3qsf-efc5
summary 
Open Redirect in apostrophe
Versions of `apostrophe` prior to 2.92.0 are vulnerable to Open Redirect. The package redirected requests to third-party websites if escaped URLs followed by a trailing `/` were appended at the end.



## Recommendation

Update to version 2.92.0 or later.
references
0
reference_url https://github.com/apostrophecms/apostrophe
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apostrophecms/apostrophe
1
reference_url https://github.com/apostrophecms/apostrophe/commit/1eba144bb82bd43dab72ce36cfbd593361b6d9b7
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apostrophecms/apostrophe/commit/1eba144bb82bd43dab72ce36cfbd593361b6d9b7
2
reference_url https://snyk.io/vuln/SNYK-JS-APOSTROPHE-451089
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://snyk.io/vuln/SNYK-JS-APOSTROPHE-451089
3
reference_url https://www.npmjs.com/advisories/1029
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.npmjs.com/advisories/1029
4
reference_url https://github.com/advisories/GHSA-h97g-4mx7-5p2p
reference_id GHSA-h97g-4mx7-5p2p
reference_type
scores
url https://github.com/advisories/GHSA-h97g-4mx7-5p2p
fixed_packages
0
url pkg:npm/apostrophe@2.92.0
purl pkg:npm/apostrophe@2.92.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-5v79-remg-7ub4
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/apostrophe@2.92.0
aliases GHSA-h97g-4mx7-5p2p, GMS-2020-704
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-pvxq-3qsf-efc5
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:npm/apostrophe@0.4.10