PT-2024-23858 · Strapi · Strapi

Cxdavidepaalte · Published 2024-06-12 · Updated 2025-12-30 · CVE-2024-31217

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Strapi versions prior to 4.22.0

Description A denial-of-service issue is present in the media upload process, causing the server to crash without restarting. This affects both development and production environments. Usually, errors in the application cause it to log the error and keep running for other clients, but this behavior stops the server execution, making it unavailable until manually restarted. Any user with access to the file upload functionality can exploit this issue. The estimated number of potentially affected devices is not provided.

Recommendations For versions prior to 4.22.0, upgrade @strapi/plugin-upload to version 4.22.0 to receive a patch. As a temporary workaround, consider restricting access to the file upload functionality to minimize the risk of exploitation.

Exploit

Fix

DoS

Weakness Enumeration

CWE-248

Related Identifiers

CVE-2024-31217

GHSA-PM9Q-XJ9P-96PM

Affected Products

Strapi

References · 10

• 🔥 https://github.com/strapi/strapi/security/advisories/GHSA-pm9q-xj9p-96pm · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31217.json · Exploit
• https://github.com/strapi/strapi/commit/a0da7e73e1496d835fe71a2febb14f70170135c7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-31217 · Security Note
• https://osv.dev/vulnerability/GHSA-pm9q-xj9p-96pm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-31217 · Vendor Advisory
• https://github.com/strapi/strapi · Note
• https://twitter.com/dailycve/status/1974207329219256700 · Twitter Post
• https://twitter.com/dailycve/status/2006035358388044131 · Twitter Post
• https://t.me/cvenotify/96131 · Telegram Post