GHSA-7frv-9phw-vrvr

ghsaUSosv

Authorization bypass in Strapi

view advisory published 2021-05-10Licence: CC-BY-4.0

`admin/src/containers/InputModalStepperProvider/index.js` in Strapi before 3.2.5 has unwanted `/proxy?url=` functionality.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-27664US	critical9.8OT elevated	2.29% (83rd)	—	2020-10-22
admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality.

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.