Search for packages
| purl | pkg:npm/strapi@3.0.0-alpha.25.2 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-gkb4-ad7n-byd5
Aliases: CVE-2020-13961 GHSA-65wv-528r-m892 |
Improper Input Validation Strapi could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any sanitation. By sending a specially crafted request, an attacker could exploit this vulnerability to update the email template for both password reset and account confirmation emails. |
Affected by 3 other vulnerabilities. |
|
VCID-kzmr-p64p-fycf
Aliases: CVE-2020-27665 GHSA-4p55-xj37-fx7g |
Incorrect Default Permissions In Strapi, there is no `admin::hasPermissions` restriction for CTB (aka content-type-builder) routes. |
Affected by 0 other vulnerabilities. |
|
VCID-q6f6-pmnx-eua8
Aliases: CVE-2019-19609 GHSA-9p2w-rmx4-9mw7 GMS-2020-779 |
Command Injection in strapi Versions of `strapi` before 3.0.0-beta.17.8 are vulnerable to Command Injection. The package fails to sanitize plugin names in the `/admin/plugins/install/` route. This may allow an authenticated attacker with admin privileges to run arbitrary commands in the server. |
Affected by 5 other vulnerabilities. |
|
VCID-r9jw-pgw5-guh5
Aliases: CVE-2020-27664 GHSA-7frv-9phw-vrvr |
Improper Input Validation `admin/src/containers/InputModalStepperProvider/index.js` in Strapi has unwanted `/proxy?url=` functionality. |
Affected by 0 other vulnerabilities. |
|
VCID-vu2b-re6f-n7fd
Aliases: CVE-2020-8123 GHSA-23fp-fmrv-f5px |
Uncontrolled Resource Consumption A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application. |
Affected by 7 other vulnerabilities. |
|
VCID-yafu-6e7s-y3cw
Aliases: CVE-2020-27666 GHSA-qvp5-mm7v-4f36 |
Cross-site Scripting Strapi has stored XSS in the wysiwyg editor's preview feature. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||