GHSA-9P2W-RMX4-9MW7 Command Injection in strapi

Versions of strapi before 3.0.0-beta.17.8 are vulnerable to Command Injection. The package fails to sanitize plugin names in the /admin/plugins/install/ route. This may allow an authenticated attacker with admin privileges to run arbitrary commands in the server. Recommendation Upgrade to version...

Authorization Bypass

strapi is vulnerable to authorization bypass. The vulnerability exists as the email templates are improperly stored in a global variable, allowing the password reset and account confirmation email templates to be updated...

Strapi Input Validation Error Vulnerability

Strapi is an open source headless content management system CMS. A security vulnerability exists in versions of Strapi prior to 3.0.2, which arises from the program storing templates in global variables after failing to perform arbitrary cleanup operations. A remote attacker can exploit this...

CVE-2020-13961

Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any sanitation. By sending a specially crafted request, an attacker could exploit this vulnerability to update the email template for both...

CVE-2020-13961

Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any sanitation. By sending a specially crafted request, an attacker could exploit this vulnerability to update the email template for both...

Design/Logic Flaw

Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any sanitation. By sending a specially crafted request, an attacker could exploit this vulnerability to update the email template for both...

CVE-2020-13961

Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any sanitation. By sending a specially crafted request, an attacker could exploit this vulnerability to update the email template for both...

CVE-2020-13961

CVE-2020-13961 affects Strapi before 3.0.2. A remote authenticated attacker can bypass security restrictions by exploiting templates stored in a global variable without sanitation, compelling an update to email templates for password reset and account confirmation via a crafted request. Impact is...

OS Command Injection

strapi is vulnerable to OS command injection. An attacker with administrative privileges is able to inject and execute arbitrary OS commands on the system via the install and uninstall plugins module due to a lack of validation in the plugin name...

CVE-2020-8123

A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application...

CVE-2020-8123

A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application...

Denial of service

A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application...

CVE-2020-8123

CVE-2020-8123 affects Strapi up to v3.0.0-beta.18.3 and earlier. The vulnerability arises in the admin console where installPlugin/uninstallPlugin paths pass user input to execa after a regex check, allowing argument injection via inputs like -h, --help, -v, or --version. This can cause the serve...

CVE-2020-8123

A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application...

Denial Of Service (DoS)

strapi is vulnerable to denial of service DoS. The vulnerability exists as the value of plugin, as used in Admin.js, can lead to an argument injection...

Node.js third-party modules: Denial Of Service in Strapi Framework using argument injection

I would like to report Denial Of Service in Strapi Framework.It allows attacker to force restart the server using argument injection. Module module name: strapi version: 3.0.0-beta.18.3 and earlier npm page: https://www.npmjs.com/package/strapi Module Description The Strapi HTTP layer sits on top...

CVE-2019-19609

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function...

CVE-2019-19609

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function...

Remote code execution

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function...

CVE-2019-19609

CVE-2019-19609 affects Strapi framework versions before 3.0.0-beta.17.8. The vulnerability is Remote Code Execution in the Admin panel’s Install/Uninstall Plugin components caused by unsanitized plugin names, allowing execution of arbitrary shell commands via execa. Documents show authenticated a...