GitHub Advisoryadvisory · npm

GHSA-37hx-4mcq-wc3h Weak Password Recovery Mechanism for Forgotten Password in Strapi

HIGH Published 2021-10-06 Modified 2021-10-06 Official page ↗
Aliases
CVE-2021-28128
Ecosystem
npm
Packages
strapi
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-640
Reviewed
2021-10-06

Affected packages

• npm strapi: <= 3.6.0 (no fix yet)

Description

In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password.

Related

Alias · CVE (1)

  • CVE-2021-28128 In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. vulnerability

Weakness · CWE (1)

  • CWE-640 Weak Password Recovery Mechanism for Forgotten Password weakness

References