@apollo/server vulnerable to unsafe application of Content Security Policy via reused nonces

Context Content Security Policies CSP are a defense-in-depth strategy against XSS attacks. Improper application of CSP isn't itself a vulnerability, but it does fail to prevent XSS in the event that there is a viable attack vector for an XSS attack. Impact There aren't any XSS attack vectors via...

PT-2023-32982 · Apollo Graphql · Apollo Server

Name of the Vulnerable Software and Affected Versions: Apollo Server versions prior to 4.7.4 Description: The issue concerns the improper application of Content Security Policies CSP in Apollo Server's landing pages, which could fail to prevent XSS attacks if a viable attack vector exists. Althou...