GitHub Advisoryadvisory · npm

GHSA-mcqm-6ff4-53qx Cross-site Scripting in Strapi

MEDIUM Published 2022-06-14 Modified 2022-06-24 Official page ↗
Aliases
CVE-2022-29894
Ecosystem
npm
Packages
strapi
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-06-24

Affected packages

• npm strapi: <= 3.6.10 (no fix yet)

Description

Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege.

Related

Alias · CVE (1)

  • CVE-2022-29894 Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References