@mattie-bundle/mattie-strapi-bundle-example (>=1.0.0-alpha.0, <=1.0.0-alpha.3), @rogwild/strapi-utils (>=2.1.0, <=2.2.0) +6 more potentially affected by unknown CVE via @strapi/plugin-users-permissions (>=4.0.0-beta.0, <=4.5.1)

@strapi/plugin-users-permissions NPM version =4.0.0-beta.0, =1.0.0-alpha.0, =2.1.0, =1.0.0, =1.0.2 - easylaser-vn-cms 0.1.0 - strapi-ent-a 0.1.0 - strapi-fcm 0.1.0 - strapi-voting 0.2.1 - sveltekit-strapi 0.1.0 Source cves: unknown CVE Source advisory: GHSA-XV3Q-JRMM-4FXV...

Authentication Bypass

strapi-plugin-ezforms is vulnerable to authentication bypass. The vulnerability exists due to improper capture validation which allows a malicious user to login into the system using unauthorized capture...

GHSA-8MGQ-6R2Q-82W9 Captcha Bypass in strapi-plugin-ezforms

Impact Users using any captcha providers Patches 0.1.0 References Issue...

Captcha Bypass in strapi-plugin-ezforms

Impact Users using any captcha providers Patches 0.1.0 References Issue...

@symbol-it/strapi-plugin-mailjet (>=0.0.1, <=0.0.2), @zerops/strapi-builder (>=0.0.34, <=0.1.13) +4 more potentially affected by CVE-2020-13961 via strapi (>=3.0.0-alpha.26, <=3.0.0)

strapi NPM version =3.0.0-alpha.26, =0.0.1, =0.0.34, =0.0.1-alpha.1, =0.0.1-alpha.2 - strapi-plugin-mailjet 0.0.2 Source cves: CVE-2020-13961 Source advisory: OSV:GHSA-65WV-528R-M892...

@mattie-bundle/mattie-strapi-bundle-example (>=1.0.0-alpha.0, <=1.0.0-alpha.1), @strapi/admin (>=0.0.0-a3ff110fc401ef4fbd6cd90780bf87a83a2cb04b, <=0.0.0-next.ff946d2c25a3e577b47132a357cac2932eb8e635) +3 more potentially affected by CVE-2022-30617 via @strapi/strapi (>=0.0.0-a3ff110fc401ef4fbd6cd90780bf87a83a2cb04b, <=4.0.0-beta.0)

@strapi/strapi NPM version =0.0.0-a3ff110fc401ef4fbd6cd90780bf87a83a2cb04b, =1.0.0-alpha.0, =0.0.0-a3ff110fc401ef4fbd6cd90780bf87a83a2cb04b, =0.0.0-a3ff110fc401ef4fbd6cd90780bf87a83a2cb04b, =0.0.0-a9fe3a0191870500b7f56ff7dd30fdda494e666a, =0.0.0-next.f45143c5e2a8a9d85691d0abf79a3f42024a0c71 Sourc...

CVE-2021-46440

Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a victim's HTTP request, get the victim's cookie, perform a base64 decode on the victim's cookie, and obtain a cleartext password, leading to...

CVE-2021-46440

Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a victim's HTTP request, get the victim's cookie, perform a base64 decode on the victim's cookie, and obtain a cleartext password, leading to...

Insecure Authorization

strapi-plugin-content-type-builder suffers from insecure authorization. The admin::hasPermissions restriction for the content-type-builder CTB routes are not configured, allowing unauthorized access to the affected resources...

@koj/strapi (>=0.0.0, <=1.4.0), strapi-editorjs (0.0.1) +1 more potentially affected by CVE-2020-27666 via strapi-plugin-content-manager (>=3.0.0-beta.18.7, <=3.1.6)

strapi-plugin-content-manager NPM version =3.0.0-beta.18.7, =0.0.0, =0.0.1-alpha.1, =0.0.1-alpha.2 Source cves: CVE-2020-27666 Source advisory: OSV:GHSA-QVP5-MM7V-4F36...

@koj/strapi (>=0.0.0, <=1.4.0), strapi-editorjs (0.0.1) +1 more potentially affected by CVE-2020-27666 via strapi-plugin-content-manager (>=3.0.0-beta.18.7, <=3.1.6)

strapi-plugin-content-manager NPM version =3.0.0-beta.18.7, =0.0.0, =0.0.1-alpha.1, =0.0.1-alpha.2 Source cves: CVE-2020-27666 Source advisory: GHSA-QVP5-MM7V-4F36...

@koj/strapi (>=0.0.0, <=1.4.0) potentially affected by CVE-2020-27665 via strapi-plugin-content-type-builder (3.1.6)

strapi-plugin-content-type-builder NPM version 3.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on strapi-plugin-content-type-builder and may be impacted: - @koj/strapi =0.0.0, =1.4.0 Source cves: CVE-2020-27665 Source advisory: OSV:GHSA-4P55-XJ37-FX...

@koj/strapi (>=0.0.0, <=1.4.0) potentially affected by CVE-2020-27665 via strapi-plugin-content-type-builder (3.1.6)

strapi-plugin-content-type-builder NPM version 3.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on strapi-plugin-content-type-builder and may be impacted: - @koj/strapi =0.0.0, =1.4.0 Source cves: CVE-2020-27665 Source advisory: GHSA-4P55-XJ37-FX7G...

Unsecured Proxy

strapi-plugin-upload contains an unsecured proxy. An unauthenticated user is able to access the proxy without any authorization, allowing for access to other protected resources...

@koj/strapi (>=0.0.0, <=1.4.0) potentially affected by CVE-2020-27665 via strapi-plugin-content-type-builder (3.1.6)

strapi-plugin-content-type-builder NPM version 3.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on strapi-plugin-content-type-builder and may be impacted: - @koj/strapi =0.0.0, =1.4.0 Source cves: CVE-2020-27665 Source advisory: MEND:CVE-2020-27665...

@koj/strapi (>=0.0.0, <=1.4.0), strapi-editorjs (0.0.1) +1 more potentially affected by CVE-2020-27666 via strapi-plugin-content-manager (>=3.0.0-beta.18.7, <=3.1.6)

strapi-plugin-content-manager NPM version =3.0.0-beta.18.7, =0.0.0, =0.0.1-alpha.1, =0.0.1-alpha.2 Source cves: CVE-2020-27666 Source advisory: MEND:CVE-2020-27666...

PT-2019-15677

Name of the Vulnerable Software and Affected Versions strapi versions prior to 3.0.0-beta.17.5 Description The issue is related to the mishandling of password resets within the strapi-admin and strapi-plugin-users-permissions packages. Specifically, the password reset routes allow an...

CVE-2019-18818: Weak Password Recovery Mechanism for Forgotten Password

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js...