CVE-2024-23841
CVSS V2 None
CVSS V3 None
Description
apollo-client-nextjs is the Apollo Client support for the Next.js App Router. The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this vulnerability, an attacker would need to either inject malicious input (e.g. by redirecting a user to a specifically-crafted link) or arrange to have malicious input be returned by a GraphQL server (e.g. by persisting it in a database). To fix this issue, please update to version 0.7.0 or later.
Overview
- CVE ID
- CVE-2024-23841
- Assigner
- GitHub_M
- Vulnerability Status
- PUBLISHED
- Published Version
- 2024-01-30T17:14:12.023Z
- Last Modified Date
- 2024-01-30T17:14:12.023Z
Weakness Enumerations
References
| Reference URL | Reference Tags |
|---|---|
| https://github.com/apollographql/apollo-client-nextjs/security/advisories/GHSA-rv8p-rr2h-fgpg | x_refsource_CONFIRM |
| https://github.com/apollographql/apollo-client-nextjs/commit/b92bc42abd5f8e17d4db361c36bd08e4f541a46b | x_refsource_MISC |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2024-23841 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23841 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2024-06-26 07:16:09 | Added to TrackCVE |