PT-2022-19900 · Strapi · Strapi

Yuta Morioka · Published 2022-06-13 · Updated 2022-06-22 · CVE-2022-29894

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Strapi versions 3.x.x and earlier

Description The issue is related to a stored cross-site scripting vulnerability in the file upload function. This vulnerability allows an arbitrary script to be executed on the web browser of the user who is logging in to the product with administrative privilege.

Recommendations For Strapi versions 3.x.x and earlier, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-29894

GHSA-MCQM-6FF4-53QX

Affected Products

Strapi

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-29894 · Security Note
• https://strapi.io · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29894 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mcqm-6ff4-53qx · Vendor Advisory
• https://github.com/strapi/strapi · Note
• https://t.me/cvenotify/31486 · Telegram Post
• https://t.me/cibsecurity/44249 · Telegram Post
• https://jvn.jp/en/jp/JVN44550983/index.html · Note