Threats tagged 'ghsa-vmg4-6gfg-83qx'

ApostropheCMS versions prior to 4.32.1 are vulnerable to a second-order prototype pollution vulnerability via a PATCH request to the article API endpoint. An attacker with a valid editor session can submit a specially crafted payload that overwrites the global toString function, causing a persistent denial-of-service condition in a single request. This vulnerability has a CVSS 4.0 score of 7.1 and is classified as high severity. A fix is available in version 4.32.1.