Design/Logic Flaw

In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB aka content-type-builder routes...

Cross site scripting

Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature...

Code injection

admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality...

CVE-2020-27664

Strapi prior to 3.2.5 contains a vulnerability in admin/src/containers/InputModalStepperProvider/index.js enabling an unwanted proxy/ URL parameter handling ("/proxy?url=") that could be abused. Public sources (NVD entry CVE-2020-27664, Red Hat advisory, GitHub/OSSV and GHSA) document this as an ...

CVE-2020-27664

admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality...

CVE-2020-27664

admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality...

CVE-2020-27665

CVE-2020-27665 affects Strapi before 3.2.5, where the admin::hasPermissions restriction is not enforced for CTB (content-type-builder) routes. The root cause is missing authorization controls on CTB routes, enabling potential unauthorized access to resources via CTB endpoints. Public details in c...

CVE-2020-27665

In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB aka content-type-builder routes...

CVE-2020-27665

In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB aka content-type-builder routes...

CVE-2020-27666

Strapi before 3.2.5 is affected by a stored XSS in the WYSIWYG editor’s preview feature. The vulnerability arises from unvalidated input being stored and subsequently rendered, enabling an attacker to inject scripts that run in a victim’s browser. A fix is available in Strapi 3.2.5 (see reference...

CVE-2020-27666

Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature...

CVE-2020-27666

Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature...

PT-2020-16758

Name of the Vulnerable Software and Affected Versions Strapi versions prior to 3.2.5 Description The issue concerns stored XSS in the wysiwyg editor's preview feature. Recommendations For versions prior to 3.2.5, update to version 3.2.5 or later to resolve the issue...

CVE-2020-27666: Improper Neutralization of Input During Web Page Generation

Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature...

CVE-2020-27665: Incorrect Default Permissions

In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB aka content-type-builder routes...

PT-2020-16757

Name of the Vulnerable Software and Affected Versions Strapi versions prior to 3.2.5 Description The issue arises from the lack of admin::hasPermissions restriction for CTB content-type-builder routes. This means that there are no proper access controls in place for these specific routes,...

PT-2020-16756

Name of the Vulnerable Software and Affected Versions Strapi versions prior to 3.2.5 Description The issue concerns unwanted /proxy?url= functionality in the admin/src/containers/InputModalStepperProvider/index.js file. This functionality can be exploited, but details about real-world incidents o...

CVE-2020-27664: Undefined Security Weakness

admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality...

GHSA-9P2W-RMX4-9MW7 Command Injection in strapi

Versions of strapi before 3.0.0-beta.17.8 are vulnerable to Command Injection. The package fails to sanitize plugin names in the /admin/plugins/install/ route. This may allow an authenticated attacker with admin privileges to run arbitrary commands in the server. Recommendation Upgrade to version...

Command Injection in strapi

Versions of strapi before 3.0.0-beta.17.8 are vulnerable to Command Injection. The package fails to sanitize plugin names in the /admin/plugins/install/ route. This may allow an authenticated attacker with admin privileges to run arbitrary commands in the server. Recommendation Upgrade to version...