Detections
Analytics
SCA: security update for apostrophe (GHSA-653j-g8j7-gh54)
medium Tenable Cloud Security Plugin ID 476369
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the self-service
password-change endpoint verifies the current password but does not use the login module’s failed-attempt
counter, throttle, delay, or lockout mechanism. An attacker with a valid authenticated session can submit
repeated guesses for the current password without receiving a lockout or throttle response. This issue is
fixed in version 4.33.0. (CVE-2026-113710)
Solution
Update the apostrophe library and its related packages to version 4.33.0 or later.See Also
Plugin Details
Severity: Medium
ID: 476369
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 10/20/2026
Updated: 10/20/2026
Risk Information
VPR
Risk Factor: Medium
Score: 4.3
Percentile: 53.5
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 6.2
Temporal Score: 4.6
Vector: CVSS2#AV:N/AC:H/Au:M/C:C/I:C/A:N
CVSS Score Source: CVE-2026-113710
CVSS v3
Risk Factor: Medium
Base Score: 5.9
Temporal Score: 5.2
Vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 10/20/2026
Vulnerability Publication Date: 10/20/2026
Reference Information
CVE: CVE-2026-113710
cwe: CWE-307