9.8

CVE-2019-18818

Exploit
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Strapi ≫ Strapi Version <= 1.6.4
Strapi ≫ Strapi Version 3.0.0 Update alpha10.1
Strapi ≫ Strapi Version 3.0.0 Update alpha10.2
Strapi ≫ Strapi Version 3.0.0 Update alpha10.3
Strapi ≫ Strapi Version 3.0.0 Update alpha11
Strapi ≫ Strapi Version 3.0.0 Update alpha11.1
Strapi ≫ Strapi Version 3.0.0 Update alpha11.2
Strapi ≫ Strapi Version 3.0.0 Update alpha11.3
Strapi ≫ Strapi Version 3.0.0 Update alpha12
Strapi ≫ Strapi Version 3.0.0 Update alpha12.1
Strapi ≫ Strapi Version 3.0.0 Update alpha12.1.3
Strapi ≫ Strapi Version 3.0.0 Update alpha12.2
Strapi ≫ Strapi Version 3.0.0 Update alpha12.3
Strapi ≫ Strapi Version 3.0.0 Update alpha12.4
Strapi ≫ Strapi Version 3.0.0 Update alpha12.5
Strapi ≫ Strapi Version 3.0.0 Update alpha12.6
Strapi ≫ Strapi Version 3.0.0 Update alpha12.7
Strapi ≫ Strapi Version 3.0.0 Update alpha12.7.1
Strapi ≫ Strapi Version 3.0.0 Update alpha13
Strapi ≫ Strapi Version 3.0.0 Update alpha13.0.1
Strapi ≫ Strapi Version 3.0.0 Update alpha13.1
Strapi ≫ Strapi Version 3.0.0 Update alpha14
Strapi ≫ Strapi Version 3.0.0 Update alpha14.1
Strapi ≫ Strapi Version 3.0.0 Update alpha14.1.1
Strapi ≫ Strapi Version 3.0.0 Update alpha14.2
Strapi ≫ Strapi Version 3.0.0 Update alpha14.3
Strapi ≫ Strapi Version 3.0.0 Update alpha14.4.0
Strapi ≫ Strapi Version 3.0.0 Update alpha14.5
Strapi ≫ Strapi Version 3.0.0 Update alpha15
Strapi ≫ Strapi Version 3.0.0 Update alpha16
Strapi ≫ Strapi Version 3.0.0 Update alpha17
Strapi ≫ Strapi Version 3.0.0 Update alpha18
Strapi ≫ Strapi Version 3.0.0 Update alpha19
Strapi ≫ Strapi Version 3.0.0 Update alpha20
Strapi ≫ Strapi Version 3.0.0 Update alpha21
Strapi ≫ Strapi Version 3.0.0 Update alpha22
Strapi ≫ Strapi Version 3.0.0 Update alpha23
Strapi ≫ Strapi Version 3.0.0 Update alpha23.1
Strapi ≫ Strapi Version 3.0.0 Update alpha24
Strapi ≫ Strapi Version 3.0.0 Update alpha24.1
Strapi ≫ Strapi Version 3.0.0 Update alpha25
Strapi ≫ Strapi Version 3.0.0 Update alpha25.1
Strapi ≫ Strapi Version 3.0.0 Update alpha25.2
Strapi ≫ Strapi Version 3.0.0 Update alpha26
Strapi ≫ Strapi Version 3.0.0 Update alpha26.1
Strapi ≫ Strapi Version 3.0.0 Update alpha26.2
Strapi ≫ Strapi Version 3.0.0 Update alpha4
Strapi ≫ Strapi Version 3.0.0 Update alpha4.8
Strapi ≫ Strapi Version 3.0.0 Update alpha5.3
Strapi ≫ Strapi Version 3.0.0 Update alpha5.5
Strapi ≫ Strapi Version 3.0.0 Update alpha6.3
Strapi ≫ Strapi Version 3.0.0 Update alpha6.4
Strapi ≫ Strapi Version 3.0.0 Update alpha6.7
Strapi ≫ Strapi Version 3.0.0 Update alpha7.2
Strapi ≫ Strapi Version 3.0.0 Update alpha7.3
Strapi ≫ Strapi Version 3.0.0 Update alpha8
Strapi ≫ Strapi Version 3.0.0 Update alpha8.3
Strapi ≫ Strapi Version 3.0.0 Update alpha9
Strapi ≫ Strapi Version 3.0.0 Update alpha9.1
Strapi ≫ Strapi Version 3.0.0 Update alpha9.2
Strapi ≫ Strapi Version 3.0.0 Update beta0
Strapi ≫ Strapi Version 3.0.0 Update beta1
Strapi ≫ Strapi Version 3.0.0 Update beta10
Strapi ≫ Strapi Version 3.0.0 Update beta11
Strapi ≫ Strapi Version 3.0.0 Update beta12
Strapi ≫ Strapi Version 3.0.0 Update beta13
Strapi ≫ Strapi Version 3.0.0 Update beta14
Strapi ≫ Strapi Version 3.0.0 Update beta15
Strapi ≫ Strapi Version 3.0.0 Update beta16
Strapi ≫ Strapi Version 3.0.0 Update beta16.1
Strapi ≫ Strapi Version 3.0.0 Update beta16.2
Strapi ≫ Strapi Version 3.0.0 Update beta16.3
Strapi ≫ Strapi Version 3.0.0 Update beta16.4
Strapi ≫ Strapi Version 3.0.0 Update beta16.5
Strapi ≫ Strapi Version 3.0.0 Update beta16.6
Strapi ≫ Strapi Version 3.0.0 Update beta16.7
Strapi ≫ Strapi Version 3.0.0 Update beta16.8
Strapi ≫ Strapi Version 3.0.0 Update beta17
Strapi ≫ Strapi Version 3.0.0 Update beta17.1
Strapi ≫ Strapi Version 3.0.0 Update beta17.2
Strapi ≫ Strapi Version 3.0.0 Update beta17.3
Strapi ≫ Strapi Version 3.0.0 Update beta17.4
Strapi ≫ Strapi Version 3.0.0 Update beta2
Strapi ≫ Strapi Version 3.0.0 Update beta3
Strapi ≫ Strapi Version 3.0.0 Update beta4
Strapi ≫ Strapi Version 3.0.0 Update beta5
Strapi ≫ Strapi Version 3.0.0 Update beta6
Strapi ≫ Strapi Version 3.0.0 Update beta7
Strapi ≫ Strapi Version 3.0.0 Update beta8
Strapi ≫ Strapi Version 3.0.0 Update beta9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 97.64% 0.999
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-640 Weak Password Recovery Mechanism for Forgotten Password

The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

http://packetstormsecurity.com/files/163939/Strapi-3.0.0-beta-Authentication-Bypass.html
Third Party Advisory
Exploit
VDB Entry
http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html
Third Party Advisory
Exploit
VDB Entry
http://packetstormsecurity.com/files/165896/Strapi-CMS-3.0.0-beta.17.4-Privilege-Escalation.html
Third Party Advisory
Exploit
VDB Entry
https://github.com/strapi/strapi/pull/4443
Third Party Advisory
https://github.com/strapi/strapi/releases/tag/v3.0.0-beta.17.5
Third Party Advisory
Release Notes
https://www.npmjs.com/advisories/1311
Third Party Advisory