PT-2019-15677

Name of the Vulnerable Software and Affected Versions strapi versions prior to 3.0.0-beta.17.5 Description The issue is related to the mishandling of password resets within the strapi-admin and strapi-plugin-users-permissions packages. Specifically, the password reset routes allow an...

CVE-2019-18818: Weak Password Recovery Mechanism for Forgotten Password

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js...