CRITICAL🇵🇱 Wersja polska

CVE-2019-18818

CVSS 9.8v3.1pub. 2019-11-07upd. 2024-11-21

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Strapi

    APP
    Strapi
    3.0.0≤ 1.6.4
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-22599CRITICAL9.3PL ✓same product

SQL Injection w Strapi Content-Type Builder — możliwe RCE i odczyt plików

CVE-2026-27886CRITICAL9.2PL ✓same product

Strapi: Path Traversal w filtrach relacyjnych umożliwia przejęcie konta admina

CVE-2022-27263CRITICAL9.8PL ✓same product

Arbitrary file upload umożliwiający RCE w Strapi v4.1.5

CVE-2020-27664CRITICAL9.8PL ✓same product

Nieautoryzowany endpoint proxy w Strapi — podatność SSRF/proxy

CVE-2024-56143HIGH8.2same product

Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the looku...