Read the docs
TI-2019-13554 Aliases CVE-2019-18818GHSA-6xc2-mj39-q599

strapi before 3.0.0-beta.17.5 mishandles password resets within…

Priority CRITICAL 87CWE-640Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-640.

Summary

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.

Why it matters now

EPSS 0.97639 99th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Fixed strapi (npm): 3.0.0-beta.17.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—strapi (npm)before 3.0.0-beta.17.53.0.0-beta.17.5Patch availableGHSA-6xc2-mj39-q599
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • strapi (npm) Vendor— Affected before 3.0.0-beta.17.5 Fixed in 3.0.0-beta.17.5 Patch available GHSA-6xc2-mj39-q599

CPE configurations NVD · 90

CPEVersionsRoleVendor
cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*up to 1.6.4VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha10.1:*:*:*:*:*:*3.0.0 alpha10.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha10.2:*:*:*:*:*:*3.0.0 alpha10.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha10.3:*:*:*:*:*:*3.0.0 alpha10.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha11:*:*:*:*:*:*3.0.0 alpha11VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha11.1:*:*:*:*:*:*3.0.0 alpha11.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha11.2:*:*:*:*:*:*3.0.0 alpha11.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha11.3:*:*:*:*:*:*3.0.0 alpha11.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12:*:*:*:*:*:*3.0.0 alpha12VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1:*:*:*:*:*:*3.0.0 alpha12.1VulnerableStrapi
  • cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:* Versions up to 1.6.4 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha10.1:*:*:*:*:*:* Versions 3.0.0 alpha10.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha10.2:*:*:*:*:*:* Versions 3.0.0 alpha10.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha10.3:*:*:*:*:*:* Versions 3.0.0 alpha10.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha11:*:*:*:*:*:* Versions 3.0.0 alpha11 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha11.1:*:*:*:*:*:* Versions 3.0.0 alpha11.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha11.2:*:*:*:*:*:* Versions 3.0.0 alpha11.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha11.3:*:*:*:*:*:* Versions 3.0.0 alpha11.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12:*:*:*:*:*:* Versions 3.0.0 alpha12 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1:*:*:*:*:*:* Versions 3.0.0 alpha12.1 Vulnerable ·Strapi
Show 80 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1.3:*:*:*:*:*:*3.0.0 alpha12.1.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.2:*:*:*:*:*:*3.0.0 alpha12.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.3:*:*:*:*:*:*3.0.0 alpha12.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.4:*:*:*:*:*:*3.0.0 alpha12.4VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.5:*:*:*:*:*:*3.0.0 alpha12.5VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.6:*:*:*:*:*:*3.0.0 alpha12.6VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7:*:*:*:*:*:*3.0.0 alpha12.7VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7.1:*:*:*:*:*:*3.0.0 alpha12.7.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha13:*:*:*:*:*:*3.0.0 alpha13VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha13.0.1:*:*:*:*:*:*3.0.0 alpha13.0.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha13.1:*:*:*:*:*:*3.0.0 alpha13.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha14:*:*:*:*:*:*3.0.0 alpha14VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1:*:*:*:*:*:*3.0.0 alpha14.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1.1:*:*:*:*:*:*3.0.0 alpha14.1.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.2:*:*:*:*:*:*3.0.0 alpha14.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.3:*:*:*:*:*:*3.0.0 alpha14.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.4.0:*:*:*:*:*:*3.0.0 alpha14.4.0VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.5:*:*:*:*:*:*3.0.0 alpha14.5VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha15:*:*:*:*:*:*3.0.0 alpha15VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha16:*:*:*:*:*:*3.0.0 alpha16VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha17:*:*:*:*:*:*3.0.0 alpha17VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha18:*:*:*:*:*:*3.0.0 alpha18VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha19:*:*:*:*:*:*3.0.0 alpha19VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha20:*:*:*:*:*:*3.0.0 alpha20VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha21:*:*:*:*:*:*3.0.0 alpha21VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha22:*:*:*:*:*:*3.0.0 alpha22VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha23:*:*:*:*:*:*3.0.0 alpha23VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha23.1:*:*:*:*:*:*3.0.0 alpha23.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha24:*:*:*:*:*:*3.0.0 alpha24VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha24.1:*:*:*:*:*:*3.0.0 alpha24.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha25:*:*:*:*:*:*3.0.0 alpha25VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha25.1:*:*:*:*:*:*3.0.0 alpha25.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha25.2:*:*:*:*:*:*3.0.0 alpha25.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha26:*:*:*:*:*:*3.0.0 alpha26VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha26.1:*:*:*:*:*:*3.0.0 alpha26.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha26.2:*:*:*:*:*:*3.0.0 alpha26.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha4:*:*:*:*:*:*3.0.0 alpha4VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha4.8:*:*:*:*:*:*3.0.0 alpha4.8VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha5.3:*:*:*:*:*:*3.0.0 alpha5.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha5.5:*:*:*:*:*:*3.0.0 alpha5.5VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha6.3:*:*:*:*:*:*3.0.0 alpha6.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha6.4:*:*:*:*:*:*3.0.0 alpha6.4VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha6.7:*:*:*:*:*:*3.0.0 alpha6.7VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha7.2:*:*:*:*:*:*3.0.0 alpha7.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha7.3:*:*:*:*:*:*3.0.0 alpha7.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha8:*:*:*:*:*:*3.0.0 alpha8VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha8.3:*:*:*:*:*:*3.0.0 alpha8.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha9:*:*:*:*:*:*3.0.0 alpha9VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha9.1:*:*:*:*:*:*3.0.0 alpha9.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha9.2:*:*:*:*:*:*3.0.0 alpha9.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta0:*:*:*:*:*:*3.0.0 beta0VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta1:*:*:*:*:*:*3.0.0 beta1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta10:*:*:*:*:*:*3.0.0 beta10VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta11:*:*:*:*:*:*3.0.0 beta11VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta12:*:*:*:*:*:*3.0.0 beta12VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta13:*:*:*:*:*:*3.0.0 beta13VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta14:*:*:*:*:*:*3.0.0 beta14VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta15:*:*:*:*:*:*3.0.0 beta15VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16:*:*:*:*:*:*3.0.0 beta16VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16.1:*:*:*:*:*:*3.0.0 beta16.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16.2:*:*:*:*:*:*3.0.0 beta16.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16.3:*:*:*:*:*:*3.0.0 beta16.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16.4:*:*:*:*:*:*3.0.0 beta16.4VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16.5:*:*:*:*:*:*3.0.0 beta16.5VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16.6:*:*:*:*:*:*3.0.0 beta16.6VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16.7:*:*:*:*:*:*3.0.0 beta16.7VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16.8:*:*:*:*:*:*3.0.0 beta16.8VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta17:*:*:*:*:*:*3.0.0 beta17VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta17.1:*:*:*:*:*:*3.0.0 beta17.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta17.2:*:*:*:*:*:*3.0.0 beta17.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta17.3:*:*:*:*:*:*3.0.0 beta17.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta17.4:*:*:*:*:*:*3.0.0 beta17.4VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta2:*:*:*:*:*:*3.0.0 beta2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta3:*:*:*:*:*:*3.0.0 beta3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta4:*:*:*:*:*:*3.0.0 beta4VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta5:*:*:*:*:*:*3.0.0 beta5VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta6:*:*:*:*:*:*3.0.0 beta6VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta7:*:*:*:*:*:*3.0.0 beta7VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta8:*:*:*:*:*:*3.0.0 beta8VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta9:*:*:*:*:*:*3.0.0 beta9VulnerableStrapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1.3:*:*:*:*:*:* Versions 3.0.0 alpha12.1.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.2:*:*:*:*:*:* Versions 3.0.0 alpha12.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.3:*:*:*:*:*:* Versions 3.0.0 alpha12.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.4:*:*:*:*:*:* Versions 3.0.0 alpha12.4 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.5:*:*:*:*:*:* Versions 3.0.0 alpha12.5 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.6:*:*:*:*:*:* Versions 3.0.0 alpha12.6 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7:*:*:*:*:*:* Versions 3.0.0 alpha12.7 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7.1:*:*:*:*:*:* Versions 3.0.0 alpha12.7.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha13:*:*:*:*:*:* Versions 3.0.0 alpha13 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha13.0.1:*:*:*:*:*:* Versions 3.0.0 alpha13.0.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha13.1:*:*:*:*:*:* Versions 3.0.0 alpha13.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha14:*:*:*:*:*:* Versions 3.0.0 alpha14 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1:*:*:*:*:*:* Versions 3.0.0 alpha14.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1.1:*:*:*:*:*:* Versions 3.0.0 alpha14.1.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha14.2:*:*:*:*:*:* Versions 3.0.0 alpha14.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha14.3:*:*:*:*:*:* Versions 3.0.0 alpha14.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha14.4.0:*:*:*:*:*:* Versions 3.0.0 alpha14.4.0 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha14.5:*:*:*:*:*:* Versions 3.0.0 alpha14.5 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha15:*:*:*:*:*:* Versions 3.0.0 alpha15 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha16:*:*:*:*:*:* Versions 3.0.0 alpha16 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha17:*:*:*:*:*:* Versions 3.0.0 alpha17 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha18:*:*:*:*:*:* Versions 3.0.0 alpha18 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha19:*:*:*:*:*:* Versions 3.0.0 alpha19 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha20:*:*:*:*:*:* Versions 3.0.0 alpha20 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha21:*:*:*:*:*:* Versions 3.0.0 alpha21 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha22:*:*:*:*:*:* Versions 3.0.0 alpha22 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha23:*:*:*:*:*:* Versions 3.0.0 alpha23 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha23.1:*:*:*:*:*:* Versions 3.0.0 alpha23.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha24:*:*:*:*:*:* Versions 3.0.0 alpha24 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha24.1:*:*:*:*:*:* Versions 3.0.0 alpha24.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha25:*:*:*:*:*:* Versions 3.0.0 alpha25 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha25.1:*:*:*:*:*:* Versions 3.0.0 alpha25.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha25.2:*:*:*:*:*:* Versions 3.0.0 alpha25.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha26:*:*:*:*:*:* Versions 3.0.0 alpha26 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha26.1:*:*:*:*:*:* Versions 3.0.0 alpha26.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha26.2:*:*:*:*:*:* Versions 3.0.0 alpha26.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha4:*:*:*:*:*:* Versions 3.0.0 alpha4 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha4.8:*:*:*:*:*:* Versions 3.0.0 alpha4.8 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha5.3:*:*:*:*:*:* Versions 3.0.0 alpha5.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha5.5:*:*:*:*:*:* Versions 3.0.0 alpha5.5 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha6.3:*:*:*:*:*:* Versions 3.0.0 alpha6.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha6.4:*:*:*:*:*:* Versions 3.0.0 alpha6.4 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha6.7:*:*:*:*:*:* Versions 3.0.0 alpha6.7 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha7.2:*:*:*:*:*:* Versions 3.0.0 alpha7.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha7.3:*:*:*:*:*:* Versions 3.0.0 alpha7.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha8:*:*:*:*:*:* Versions 3.0.0 alpha8 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha8.3:*:*:*:*:*:* Versions 3.0.0 alpha8.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha9:*:*:*:*:*:* Versions 3.0.0 alpha9 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha9.1:*:*:*:*:*:* Versions 3.0.0 alpha9.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha9.2:*:*:*:*:*:* Versions 3.0.0 alpha9.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta0:*:*:*:*:*:* Versions 3.0.0 beta0 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta1:*:*:*:*:*:* Versions 3.0.0 beta1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta10:*:*:*:*:*:* Versions 3.0.0 beta10 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta11:*:*:*:*:*:* Versions 3.0.0 beta11 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta12:*:*:*:*:*:* Versions 3.0.0 beta12 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta13:*:*:*:*:*:* Versions 3.0.0 beta13 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta14:*:*:*:*:*:* Versions 3.0.0 beta14 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta15:*:*:*:*:*:* Versions 3.0.0 beta15 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16:*:*:*:*:*:* Versions 3.0.0 beta16 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16.1:*:*:*:*:*:* Versions 3.0.0 beta16.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16.2:*:*:*:*:*:* Versions 3.0.0 beta16.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16.3:*:*:*:*:*:* Versions 3.0.0 beta16.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16.4:*:*:*:*:*:* Versions 3.0.0 beta16.4 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16.5:*:*:*:*:*:* Versions 3.0.0 beta16.5 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16.6:*:*:*:*:*:* Versions 3.0.0 beta16.6 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16.7:*:*:*:*:*:* Versions 3.0.0 beta16.7 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16.8:*:*:*:*:*:* Versions 3.0.0 beta16.8 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta17:*:*:*:*:*:* Versions 3.0.0 beta17 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta17.1:*:*:*:*:*:* Versions 3.0.0 beta17.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta17.2:*:*:*:*:*:* Versions 3.0.0 beta17.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta17.3:*:*:*:*:*:* Versions 3.0.0 beta17.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta17.4:*:*:*:*:*:* Versions 3.0.0 beta17.4 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta2:*:*:*:*:*:* Versions 3.0.0 beta2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta3:*:*:*:*:*:* Versions 3.0.0 beta3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta4:*:*:*:*:*:* Versions 3.0.0 beta4 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta5:*:*:*:*:*:* Versions 3.0.0 beta5 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta6:*:*:*:*:*:* Versions 3.0.0 beta6 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta7:*:*:*:*:*:* Versions 3.0.0 beta7 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta8:*:*:*:*:*:* Versions 3.0.0 beta8 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta9:*:*:*:*:*:* Versions 3.0.0 beta9 Vulnerable ·Strapi

Remediation

  • Fix · GHSA-6xc2-mj39-q599 strapi (npm) Fixed in 3.0.0-beta.17.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-18818
  2. 2026-10-03 Alias added: GHSA-6xc2-mj39-q599

References

Exploit 3

Advisory 4

Other 2

  • TI-2023-09037 Query filter flaw in Strapi exposes sensitive user details KEVCVSS 3.1HIGH 7.2
  • TI-2023-19887 Strapi Improper Rate Limiting vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-08803 Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can… CVSS 3.1CRITICAL 10.0
  • TI-2024-25161 Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the… CVSS 3.1HIGH 8.6
  • TI-2023-17071 Leaking sensitive user information still possible by filtering on private with prefix fields CVSS 3.1HIGH 8.6
  • TI-2024-37136 Strapi Allows Unauthorized Access to Private Fields via parms.lookup CVSS 3.1HIGH 8.2
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences