CVE-2020-27664

admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality...

Authorization Bypass

Overview admin/src/containers/InputModalStepperProvider/index.js in strapi before 3.2.5 has unwanted /proxy?url= functionality. Recommendation Upgrade to version 3.2.5 or later References - CVE - GitHub Advisory...

@koj/strapi (>=0.0.0, <=1.4.0), @symbol-it/strapi-plugin-mailjet (>=0.0.1, <=0.0.2) +5 more potentially affected by CVE-2020-27664 via strapi (>=3.0.0, <=3.1.6)

strapi NPM version =3.0.0, =0.0.0, =0.0.1, =0.0.34, =0.0.1-alpha.1, =0.0.1-alpha.2 - strapi-plugin-mailjet 0.0.2 Source cves: CVE-2020-27664 Source advisory: OSV:GHSA-7FRV-9PHW-VRVR...

CVE-2020-27664

admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality...

CVE-2020-27664

admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality...

CVE-2020-27664

Strapi prior to 3.2.5 contains a vulnerability in admin/src/containers/InputModalStepperProvider/index.js enabling an unwanted proxy/ URL parameter handling ("/proxy?url=") that could be abused. Public sources (NVD entry CVE-2020-27664, Red Hat advisory, GitHub/OSSV and GHSA) document this as an ...