CRITICAL🇵🇱 Wersja polska

CVE-2020-27664

CVSS 9.8v3.1pub. 2020-10-22upd. 2024-11-21

admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Strapi

    APP
    Strapi
    < 3.2.5
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Container
CWE
References

Related vulnerabilities

CVE-2026-22599CRITICAL9.3PL ✓same product

SQL Injection w Strapi Content-Type Builder — możliwe RCE i odczyt plików

CVE-2026-27886CRITICAL9.2PL ✓same product

Strapi: Path Traversal w filtrach relacyjnych umożliwia przejęcie konta admina

CVE-2022-27263CRITICAL9.8PL ✓same product

Arbitrary file upload umożliwiający RCE w Strapi v4.1.5

CVE-2019-18818CRITICAL9.8PL ✓same product

Błędna obsługa resetowania hasła w Strapi przed v3.0.0-beta.17.5

CVE-2024-56143HIGH8.2same product

Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the looku...