Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-qcu6-ntuc-byea

Summary

Insecure Storage of Sensitive Information
Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi allows an attacker to access a victim's HTTP request, get the victim's cookie, perform a base64 decode on the victim's cookie, and obtain a cleartext password, leading to getting API documentation for further API attacks.

Aliases

alias	CVE-2021-46440

alias	GHSA-85vg-grr5-pw42

Fixed_packages

url	pkg:npm/strapi@3.6.9
purl	pkg:npm/strapi@3.6.9
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:npm/strapi@3.6.9

url pkg:npm/strapi@4.1.5

purl pkg:npm/strapi@4.1.5

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-jvwy-9dk1-ukd7

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/strapi@4.1.5

url	pkg:npm/%40strapi/strapi@4.1.5
purl	pkg:npm/%40strapi/strapi@4.1.5
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:npm/%2540strapi/strapi@4.1.5

Affected_packages

url pkg:npm/strapi@4.0.0

purl pkg:npm/strapi@4.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-jpqv-dukr-fyhu

vulnerability	VCID-qcu6-ntuc-byea

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/strapi@4.0.0

url pkg:npm/%40strapi/strapi@4.0.0

purl pkg:npm/%40strapi/strapi@4.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-jpqv-dukr-fyhu

vulnerability	VCID-qcu6-ntuc-byea

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/%2540strapi/strapi@4.0.0

References

reference_url	http://packetstormsecurity.com/files/166915/Strapi-3.6.8-Password-Disclosure-Insecure-Handling.html
reference_id
reference_type
scores
url	http://packetstormsecurity.com/files/166915/Strapi-3.6.8-Password-Disclosure-Insecure-Handling.html

reference_url	https://github.com/strapi/strapi/pull/12246
reference_id
reference_type
scores
url	https://github.com/strapi/strapi/pull/12246

reference_url	https://hub.docker.com/r/strapi/strapi
reference_id
reference_type
scores
url	https://hub.docker.com/r/strapi/strapi

reference_url	https://strapi.io/
reference_id
reference_type
scores
url	https://strapi.io/

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2021-46440
reference_id	CVE-2021-46440
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2021-46440

reference_url	https://github.com/advisories/GHSA-85vg-grr5-pw42
reference_id	GHSA-85vg-grr5-pw42
reference_type
scores
url	https://github.com/advisories/GHSA-85vg-grr5-pw42

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	522
name	Insufficiently Protected Credentials
description	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	922
name	Insecure Storage of Sensitive Information
description	The product stores sensitive information without properly limiting read or write access by unauthorized actors.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-qcu6-ntuc-byea

Vulnerability Instance