PT-2019-15677 · Strapi · Strapi

Published 2019-11-07 · Updated 2022-02-20 · CVE-2019-18818

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions strapi versions prior to 3.0.0-beta.17.5

Description The issue is related to the mishandling of password resets within the strapi-admin and strapi-plugin-users-permissions packages. Specifically, the password reset routes allow an unauthenticated attacker to reset an admin's password without providing a valid password reset token, potentially leading to privilege escalation.

Recommendations For strapi versions prior to 3.0.0-beta.17.5, upgrade to version 3.0.0-beta.17.5 or later.

Exploit

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2019-18818

GHSA-6XC2-MJ39-Q599

Affected Products

Strapi

References · 17

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/strapi_3_password_reset.rb · Exploit
• 🔥 https://github.com/guglia001/CVE-2019-18818 · Exploit
• 🔥 http://packetstormsecurity.com/files/165896/Strapi-CMS-3.0.0-beta.17.4-Privilege-Escalation.html · Exploit
• 🔥 https://exploit-db.com/exploits/50237 · Exploit
• 🔥 http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/50716 · Exploit
• 🔥 http://packetstormsecurity.com/files/163939/Strapi-3.0.0-beta-Authentication-Bypass.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-18818 · Security Note
• https://osv.dev/vulnerability/CVE-2019-18818 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6xc2-mj39-q599 · Vendor Advisory
• https://github.com/strapi/strapi · Note
• https://github.com/strapi/strapi/releases/tag/v3.0.0-beta.17.5 · Note
• https://github.com/strapi/strapi/pull/4443 · Note
• https://t.me/cvenotify/27092 · Telegram Post
• https://t.me/cvenotify/26461 · Telegram Post