946 matches found
CVE-2021-28128
Strapi up to version 3.6.0 contains an auth weakness in the admin panel: a user can change their own password without entering the current one. If an attacker gains any valid session, they can take over the account by changing the password. This aligns with the CVSS3.1/8.1 (HIGH) impact noted in ...
PT-2021-17761
Name of the Vulnerable Software and Affected Versions: Strapi versions prior to 3.6.1 is not mentioned, however, the version 3.6.0 is mentioned as vulnerable, so we can say Strapi versions 3.6.0 and earlier Description: The admin panel in Strapi allows users to change their own password without...
Strapi 授权问题漏洞
Strapi is an open source headless content management system CMS. A security vulnerability exists in Strapi version 3.6.0 and prior versions that allows an attacker who gains valid session access to take over an account by changing the password...
CVE-2021-28128: Weak Password Recovery Mechanism for Forgotten Password
In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password...
Insecure Authorization
strapi-plugin-content-type-builder suffers from insecure authorization. The admin::hasPermissions restriction for the content-type-builder CTB routes are not configured, allowing unauthorized access to the affected resources...
@koj/strapi (>=0.0.0, <=1.4.0), strapi-editorjs (0.0.1) +1 more potentially affected by CVE-2020-27666 via strapi-plugin-content-manager (>=3.0.0-beta.18.7, <=3.1.6)
strapi-plugin-content-manager NPM version =3.0.0-beta.18.7, =0.0.0, =0.0.1-alpha.1, =0.0.1-alpha.2 Source cves: CVE-2020-27666 Source advisory: OSV:GHSA-QVP5-MM7V-4F36...
GHSA-QVP5-MM7V-4F36 Cross-site Scripting in Strapi
Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature...
Cross-site Scripting in Strapi
Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature...
Improper Authorization in Strapi
In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB aka content-type-builder routes...
@koj/strapi (>=0.0.0, <=1.4.0) potentially affected by CVE-2020-27665 via strapi-plugin-content-type-builder (3.1.6)
strapi-plugin-content-type-builder NPM version 3.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on strapi-plugin-content-type-builder and may be impacted: - @koj/strapi =0.0.0, =1.4.0 Source cves: CVE-2020-27665 Source advisory: OSV:GHSA-4P55-XJ37-FX...
GHSA-4P55-XJ37-FX7G Improper Authorization in Strapi
In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB aka content-type-builder routes...
Strapi Cross-Site Scripting Vulnerability
Strapi is an open source headless content management system CMS. A cross-site scripting vulnerability exists in Strapi versions prior to 3.2.5, which stems from the fact that Strapi has stored XSS in the preview feature of the WYSIWYG editor, which can be exploited by an attacker to obtain user...
Unsecured Proxy
strapi-plugin-upload contains an unsecured proxy. An unauthenticated user is able to access the proxy without any authorization, allowing for access to other protected resources...
Insecure Proxy
strapi uses insecure proxy. The vulnerability exists because access to proxy gives insecure access...
CVE-2020-27664
admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality...
CVE-2020-27666
Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature...
CVE-2020-27665
In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB aka content-type-builder routes...
CVE-2020-27664
admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality...