Skip to main content
cve.nowby Sazabi
← npm
npmPackage

strapi

12 known vulnerabilities (1 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
12 · 1 high, 1 medium
Weekly downloads
11.9K
Dependents
10
Registry
npm

Advisories 12

  • Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses.

    Affected: fixed in 3.6.10.

  • Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function.

    Affected: through 3.6.10.

  • An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens…

    Affected: from 3.0.0, fixed in 3.6.9.

  • An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens…

    Affected: from 3.0.0, fixed in 3.6.9.

  • Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an…

    Affected: fixed in 3.6.9.

  • An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted…

    Affected: through 4.1.5.

  • CVE-2022-0764Medium 6.1

    Arbitrary Command Injection in strapi/strapi

    Affected: fixed in 4.1.0.

  • In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password.

    Affected: through 3.6.0.

  • admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality.

    Affected: fixed in 3.2.5.

  • Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global…

    Affected: fixed in 3.0.2.

  • The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the…

    Affected: fixed in 3.0.0-beta.17.8.

  • strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and…

    Affected: fixed in 3.0.0-beta.17.5.