Read the docs
TI-2020-06541 Aliases CVE-2020-8123GHSA-23fp-fmrv-f5px

Uncontrolled resource consumption in Strapi

Priority LOW 25CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application.

Why it matters now

EPSS 0.01145 66th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed strapi-admin (npm): 3.0.0-beta.18.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Strapiv3.0.0-beta.18.4—No fix listedCNA
—strapi-admin (npm)before 3.0.0-beta.18.43.0.0-beta.18.4Patch availableGHSA-23fp-fmrv-f5px
  • Strapi Vendor— Affected v3.0.0-beta.18.4 Fixed in — No fix listed CNA
  • strapi-admin (npm) Vendor— Affected before 3.0.0-beta.18.4 Fixed in 3.0.0-beta.18.4 Patch available GHSA-23fp-fmrv-f5px

CPE configurations NVD · 98

CPEVersionsRoleVendor
cpe:2.3:a:strapi:strapi:*:*:*:*:*:node.js:*:*before 3.0.0VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha10.1:*:*:*:node.js:*:*3.0.0 alpha10.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha10.2:*:*:*:node.js:*:*3.0.0 alpha10.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha10.3:*:*:*:node.js:*:*3.0.0 alpha10.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha11:*:*:*:node.js:*:*3.0.0 alpha11VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha11.1:*:*:*:node.js:*:*3.0.0 alpha11.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha11.2:*:*:*:node.js:*:*3.0.0 alpha11.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha11.3:*:*:*:node.js:*:*3.0.0 alpha11.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12:*:*:*:node.js:*:*3.0.0 alpha12VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1:*:*:*:node.js:*:*3.0.0 alpha12.1VulnerableStrapi
  • cpe:2.3:a:strapi:strapi:*:*:*:*:*:node.js:*:* Versions before 3.0.0 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha10.1:*:*:*:node.js:*:* Versions 3.0.0 alpha10.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha10.2:*:*:*:node.js:*:* Versions 3.0.0 alpha10.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha10.3:*:*:*:node.js:*:* Versions 3.0.0 alpha10.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha11:*:*:*:node.js:*:* Versions 3.0.0 alpha11 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha11.1:*:*:*:node.js:*:* Versions 3.0.0 alpha11.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha11.2:*:*:*:node.js:*:* Versions 3.0.0 alpha11.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha11.3:*:*:*:node.js:*:* Versions 3.0.0 alpha11.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12:*:*:*:node.js:*:* Versions 3.0.0 alpha12 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1:*:*:*:node.js:*:* Versions 3.0.0 alpha12.1 Vulnerable ·Strapi
Show 88 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1.3:*:*:*:node.js:*:*3.0.0 alpha12.1.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.2:*:*:*:node.js:*:*3.0.0 alpha12.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.3:*:*:*:node.js:*:*3.0.0 alpha12.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.4:*:*:*:node.js:*:*3.0.0 alpha12.4VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.5:*:*:*:node.js:*:*3.0.0 alpha12.5VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.6:*:*:*:node.js:*:*3.0.0 alpha12.6VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7:*:*:*:node.js:*:*3.0.0 alpha12.7VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7.1:*:*:*:node.js:*:*3.0.0 alpha12.7.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha13:*:*:*:node.js:*:*3.0.0 alpha13VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha13.0.1:*:*:*:node.js:*:*3.0.0 alpha13.0.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha13.1:*:*:*:node.js:*:*3.0.0 alpha13.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha14:*:*:*:node.js:*:*3.0.0 alpha14VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1:*:*:*:node.js:*:*3.0.0 alpha14.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1.1:*:*:*:node.js:*:*3.0.0 alpha14.1.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.2:*:*:*:node.js:*:*3.0.0 alpha14.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.3:*:*:*:node.js:*:*3.0.0 alpha14.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.4.0:*:*:*:node.js:*:*3.0.0 alpha14.4.0VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.5:*:*:*:node.js:*:*3.0.0 alpha14.5VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha15:*:*:*:node.js:*:*3.0.0 alpha15VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha16:*:*:*:node.js:*:*3.0.0 alpha16VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha17:*:*:*:node.js:*:*3.0.0 alpha17VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha18:*:*:*:node.js:*:*3.0.0 alpha18VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha19:*:*:*:node.js:*:*3.0.0 alpha19VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha20:*:*:*:node.js:*:*3.0.0 alpha20VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha21:*:*:*:node.js:*:*3.0.0 alpha21VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha22:*:*:*:node.js:*:*3.0.0 alpha22VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha23:*:*:*:node.js:*:*3.0.0 alpha23VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha23.1:*:*:*:node.js:*:*3.0.0 alpha23.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha24:*:*:*:node.js:*:*3.0.0 alpha24VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha24.1:*:*:*:node.js:*:*3.0.0 alpha24.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha25:*:*:*:node.js:*:*3.0.0 alpha25VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha25.1:*:*:*:node.js:*:*3.0.0 alpha25.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha25.2:*:*:*:node.js:*:*3.0.0 alpha25.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha26:*:*:*:node.js:*:*3.0.0 alpha26VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha26.1:*:*:*:node.js:*:*3.0.0 alpha26.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha26.2:*:*:*:node.js:*:*3.0.0 alpha26.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha4:*:*:*:node.js:*:*3.0.0 alpha4VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha4.8:*:*:*:node.js:*:*3.0.0 alpha4.8VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha5.3:*:*:*:node.js:*:*3.0.0 alpha5.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha5.5:*:*:*:node.js:*:*3.0.0 alpha5.5VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha6.3:*:*:*:node.js:*:*3.0.0 alpha6.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha6.4:*:*:*:node.js:*:*3.0.0 alpha6.4VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha6.7:*:*:*:node.js:*:*3.0.0 alpha6.7VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha7.2:*:*:*:node.js:*:*3.0.0 alpha7.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha7.3:*:*:*:node.js:*:*3.0.0 alpha7.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha8:*:*:*:node.js:*:*3.0.0 alpha8VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha8.3:*:*:*:node.js:*:*3.0.0 alpha8.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha9:*:*:*:node.js:*:*3.0.0 alpha9VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha9.1:*:*:*:node.js:*:*3.0.0 alpha9.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:alpha9.2:*:*:*:node.js:*:*3.0.0 alpha9.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta0:*:*:*:node.js:*:*3.0.0 beta0VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta1:*:*:*:node.js:*:*3.0.0 beta1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta10:*:*:*:node.js:*:*3.0.0 beta10VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta11:*:*:*:node.js:*:*3.0.0 beta11VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta12:*:*:*:node.js:*:*3.0.0 beta12VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta13:*:*:*:node.js:*:*3.0.0 beta13VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta14:*:*:*:node.js:*:*3.0.0 beta14VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta15:*:*:*:node.js:*:*3.0.0 beta15VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16:*:*:*:node.js:*:*3.0.0 beta16VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16.1:*:*:*:node.js:*:*3.0.0 beta16.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16.2:*:*:*:node.js:*:*3.0.0 beta16.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16.3:*:*:*:node.js:*:*3.0.0 beta16.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16.4:*:*:*:node.js:*:*3.0.0 beta16.4VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16.5:*:*:*:node.js:*:*3.0.0 beta16.5VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16.6:*:*:*:node.js:*:*3.0.0 beta16.6VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16.7:*:*:*:node.js:*:*3.0.0 beta16.7VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta16.8:*:*:*:node.js:*:*3.0.0 beta16.8VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta17:*:*:*:node.js:*:*3.0.0 beta17VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta17.1:*:*:*:node.js:*:*3.0.0 beta17.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta17.2:*:*:*:node.js:*:*3.0.0 beta17.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta17.3:*:*:*:node.js:*:*3.0.0 beta17.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta17.4:*:*:*:node.js:*:*3.0.0 beta17.4VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta17.5:*:*:*:node.js:*:*3.0.0 beta17.5VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta17.6:*:*:*:node.js:*:*3.0.0 beta17.6VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta17.7:*:*:*:node.js:*:*3.0.0 beta17.7VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta17.8:*:*:*:node.js:*:*3.0.0 beta17.8VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta18:*:*:*:node.js:*:*3.0.0 beta18VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta18.1:*:*:*:node.js:*:*3.0.0 beta18.1VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta18.2:*:*:*:node.js:*:*3.0.0 beta18.2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta18.3:*:*:*:node.js:*:*3.0.0 beta18.3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta2:*:*:*:node.js:*:*3.0.0 beta2VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta3:*:*:*:node.js:*:*3.0.0 beta3VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta4:*:*:*:node.js:*:*3.0.0 beta4VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta5:*:*:*:node.js:*:*3.0.0 beta5VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta6:*:*:*:node.js:*:*3.0.0 beta6VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta7:*:*:*:node.js:*:*3.0.0 beta7VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta8:*:*:*:node.js:*:*3.0.0 beta8VulnerableStrapi
cpe:2.3:a:strapi:strapi:3.0.0:beta9:*:*:*:node.js:*:*3.0.0 beta9VulnerableStrapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1.3:*:*:*:node.js:*:* Versions 3.0.0 alpha12.1.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.2:*:*:*:node.js:*:* Versions 3.0.0 alpha12.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.3:*:*:*:node.js:*:* Versions 3.0.0 alpha12.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.4:*:*:*:node.js:*:* Versions 3.0.0 alpha12.4 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.5:*:*:*:node.js:*:* Versions 3.0.0 alpha12.5 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.6:*:*:*:node.js:*:* Versions 3.0.0 alpha12.6 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7:*:*:*:node.js:*:* Versions 3.0.0 alpha12.7 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7.1:*:*:*:node.js:*:* Versions 3.0.0 alpha12.7.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha13:*:*:*:node.js:*:* Versions 3.0.0 alpha13 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha13.0.1:*:*:*:node.js:*:* Versions 3.0.0 alpha13.0.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha13.1:*:*:*:node.js:*:* Versions 3.0.0 alpha13.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha14:*:*:*:node.js:*:* Versions 3.0.0 alpha14 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1:*:*:*:node.js:*:* Versions 3.0.0 alpha14.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1.1:*:*:*:node.js:*:* Versions 3.0.0 alpha14.1.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha14.2:*:*:*:node.js:*:* Versions 3.0.0 alpha14.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha14.3:*:*:*:node.js:*:* Versions 3.0.0 alpha14.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha14.4.0:*:*:*:node.js:*:* Versions 3.0.0 alpha14.4.0 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha14.5:*:*:*:node.js:*:* Versions 3.0.0 alpha14.5 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha15:*:*:*:node.js:*:* Versions 3.0.0 alpha15 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha16:*:*:*:node.js:*:* Versions 3.0.0 alpha16 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha17:*:*:*:node.js:*:* Versions 3.0.0 alpha17 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha18:*:*:*:node.js:*:* Versions 3.0.0 alpha18 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha19:*:*:*:node.js:*:* Versions 3.0.0 alpha19 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha20:*:*:*:node.js:*:* Versions 3.0.0 alpha20 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha21:*:*:*:node.js:*:* Versions 3.0.0 alpha21 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha22:*:*:*:node.js:*:* Versions 3.0.0 alpha22 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha23:*:*:*:node.js:*:* Versions 3.0.0 alpha23 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha23.1:*:*:*:node.js:*:* Versions 3.0.0 alpha23.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha24:*:*:*:node.js:*:* Versions 3.0.0 alpha24 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha24.1:*:*:*:node.js:*:* Versions 3.0.0 alpha24.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha25:*:*:*:node.js:*:* Versions 3.0.0 alpha25 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha25.1:*:*:*:node.js:*:* Versions 3.0.0 alpha25.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha25.2:*:*:*:node.js:*:* Versions 3.0.0 alpha25.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha26:*:*:*:node.js:*:* Versions 3.0.0 alpha26 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha26.1:*:*:*:node.js:*:* Versions 3.0.0 alpha26.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha26.2:*:*:*:node.js:*:* Versions 3.0.0 alpha26.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha4:*:*:*:node.js:*:* Versions 3.0.0 alpha4 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha4.8:*:*:*:node.js:*:* Versions 3.0.0 alpha4.8 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha5.3:*:*:*:node.js:*:* Versions 3.0.0 alpha5.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha5.5:*:*:*:node.js:*:* Versions 3.0.0 alpha5.5 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha6.3:*:*:*:node.js:*:* Versions 3.0.0 alpha6.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha6.4:*:*:*:node.js:*:* Versions 3.0.0 alpha6.4 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha6.7:*:*:*:node.js:*:* Versions 3.0.0 alpha6.7 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha7.2:*:*:*:node.js:*:* Versions 3.0.0 alpha7.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha7.3:*:*:*:node.js:*:* Versions 3.0.0 alpha7.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha8:*:*:*:node.js:*:* Versions 3.0.0 alpha8 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha8.3:*:*:*:node.js:*:* Versions 3.0.0 alpha8.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha9:*:*:*:node.js:*:* Versions 3.0.0 alpha9 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha9.1:*:*:*:node.js:*:* Versions 3.0.0 alpha9.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:alpha9.2:*:*:*:node.js:*:* Versions 3.0.0 alpha9.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta0:*:*:*:node.js:*:* Versions 3.0.0 beta0 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta1:*:*:*:node.js:*:* Versions 3.0.0 beta1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta10:*:*:*:node.js:*:* Versions 3.0.0 beta10 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta11:*:*:*:node.js:*:* Versions 3.0.0 beta11 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta12:*:*:*:node.js:*:* Versions 3.0.0 beta12 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta13:*:*:*:node.js:*:* Versions 3.0.0 beta13 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta14:*:*:*:node.js:*:* Versions 3.0.0 beta14 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta15:*:*:*:node.js:*:* Versions 3.0.0 beta15 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16:*:*:*:node.js:*:* Versions 3.0.0 beta16 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16.1:*:*:*:node.js:*:* Versions 3.0.0 beta16.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16.2:*:*:*:node.js:*:* Versions 3.0.0 beta16.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16.3:*:*:*:node.js:*:* Versions 3.0.0 beta16.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16.4:*:*:*:node.js:*:* Versions 3.0.0 beta16.4 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16.5:*:*:*:node.js:*:* Versions 3.0.0 beta16.5 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16.6:*:*:*:node.js:*:* Versions 3.0.0 beta16.6 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16.7:*:*:*:node.js:*:* Versions 3.0.0 beta16.7 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta16.8:*:*:*:node.js:*:* Versions 3.0.0 beta16.8 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta17:*:*:*:node.js:*:* Versions 3.0.0 beta17 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta17.1:*:*:*:node.js:*:* Versions 3.0.0 beta17.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta17.2:*:*:*:node.js:*:* Versions 3.0.0 beta17.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta17.3:*:*:*:node.js:*:* Versions 3.0.0 beta17.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta17.4:*:*:*:node.js:*:* Versions 3.0.0 beta17.4 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta17.5:*:*:*:node.js:*:* Versions 3.0.0 beta17.5 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta17.6:*:*:*:node.js:*:* Versions 3.0.0 beta17.6 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta17.7:*:*:*:node.js:*:* Versions 3.0.0 beta17.7 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta17.8:*:*:*:node.js:*:* Versions 3.0.0 beta17.8 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta18:*:*:*:node.js:*:* Versions 3.0.0 beta18 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta18.1:*:*:*:node.js:*:* Versions 3.0.0 beta18.1 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta18.2:*:*:*:node.js:*:* Versions 3.0.0 beta18.2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta18.3:*:*:*:node.js:*:* Versions 3.0.0 beta18.3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta2:*:*:*:node.js:*:* Versions 3.0.0 beta2 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta3:*:*:*:node.js:*:* Versions 3.0.0 beta3 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta4:*:*:*:node.js:*:* Versions 3.0.0 beta4 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta5:*:*:*:node.js:*:* Versions 3.0.0 beta5 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta6:*:*:*:node.js:*:* Versions 3.0.0 beta6 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta7:*:*:*:node.js:*:* Versions 3.0.0 beta7 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta8:*:*:*:node.js:*:* Versions 3.0.0 beta8 Vulnerable ·Strapi
  • cpe:2.3:a:strapi:strapi:3.0.0:beta9:*:*:*:node.js:*:* Versions 3.0.0 beta9 Vulnerable ·Strapi

Remediation

  • Fix · GHSA-23fp-fmrv-f5px strapi-admin (npm) Fixed in 3.0.0-beta.18.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8123
  2. 2026-10-03 Alias added: GHSA-23fp-fmrv-f5px

References

Exploit 1

Advisory 1

Other 2

  • TI-2023-09037 Query filter flaw in Strapi exposes sensitive user details KEVCVSS 3.1HIGH 7.2
  • TI-2019-13554 strapi before 3.0.0-beta.17.5 mishandles password resets within… CVSS 3.1CRITICAL 9.8
  • TI-2023-19887 Strapi Improper Rate Limiting vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-08803 Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can… CVSS 3.1CRITICAL 10.0
  • TI-2024-25161 Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the… CVSS 3.1HIGH 8.6
  • TI-2023-17071 Leaking sensitive user information still possible by filtering on private with prefix fields CVSS 3.1HIGH 8.6
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences