Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1tY3FtLTZmZjQtNTNxeM4AArjX
Cross-site Scripting in Strapi
Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege.
Permalink: https://github.com/advisories/GHSA-mcqm-6ff4-53qxJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tY3FtLTZmZjQtNTNxeM4AArjX
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: about 2 years ago
CVSS Score: 4.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS Percentage: 0.00063
EPSS Percentile: 0.29516
Identifiers: GHSA-mcqm-6ff4-53qx, CVE-2022-29894
References:
- https://nvd.nist.gov/vuln/detail/CVE-2022-29894
- https://github.com/strapi/strapi
- https://jvn.jp/en/jp/JVN44550983/index.html
- https://strapi.io/
- https://github.com/advisories/GHSA-mcqm-6ff4-53qx
Blast Radius: 17.4
Affected Packages
npm:strapi
Dependent packages: 25Dependent repositories: 4,153
Downloads: 42,130 last month
Affected Version Ranges: <= 3.6.10
No known fixed version
All affected versions: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.1.0, 1.2.0, 1.3.0, 1.3.1, 1.4.0, 1.4.1, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.5.5, 1.5.6, 1.5.7, 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 2.0.1, 2.0.2, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.4.0, 3.4.1, 3.4.2, 3.4.3, 3.4.4, 3.4.5, 3.4.6, 3.5.0, 3.5.1, 3.5.2, 3.5.3, 3.5.4, 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.6.4, 3.6.5, 3.6.6, 3.6.7, 3.6.8, 3.6.9, 3.6.10