Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a victim's HTTP request, get the victim's cookie, perform a base64 decode on the victim's cookie, and obtain a cleartext password, leading to getting API documentation for further API attacks.
CVSS Score
7.5
EPSS Score
0.022
Published
2022-05-03
Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0.
CVSS Score
6.1
EPSS Score
0.008
Published
2022-02-26
In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password.
CVSS Score
8.1
EPSS Score
0.013
Published
2021-05-06
admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality.
CVSS Score
9.8
EPSS Score
0.023
Published
2020-10-22
In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) routes.
CVSS Score
7.5
EPSS Score
0.012
Published
2020-10-22
Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature.
CVSS Score
5.4
EPSS Score
0.006
Published
2020-10-22
Page 3