Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege.
References
| Link | Resource |
|---|---|
| https://github.com/strapi/strapi | Product Third Party Advisory |
| https://jvn.jp/en/jp/JVN44550983/index.html | Third Party Advisory |
| https://strapi.io/ | Vendor Advisory |
Configurations
History
22 Jun 2022, 12:12
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| First Time |
Strapi
Strapi strapi |
|
| CPE | cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : 3.5
v3 : 4.8 |
| References | (MISC) https://github.com/strapi/strapi - Product, Third Party Advisory | |
| References | (MISC) https://strapi.io/ - Vendor Advisory | |
| References | (MISC) https://jvn.jp/en/jp/JVN44550983/index.html - Third Party Advisory |
13 Jun 2022, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-06-13 05:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-29894
Mitre link : CVE-2022-29894
CVE.ORG link : CVE-2022-29894
JSON object : View
Products Affected
strapi
- strapi
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')