GHSA-mcqm-6ff4-53qx

ghsaUSosv

Cross-site Scripting in Strapi

view advisory published 2022-06-14Licence: CC-BY-4.0

Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-29894US	medium4.8	0.77% (55th)	—	2022-06-13
Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary script may be execute…

references

External citations — patches, advisories, analysis.

https://github.com/strapi/strapiPACKAGE
https://jvn.jp/en/jp/JVN44550983/index.htmlWEB
https://nvd.nist.gov/vuln/detail/CVE-2022-29894ADVISORY
https://strapi.ioWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan