CRITICAL9.8

GHSA-6xc2-mj39-q599

Strapi allows unauthenticated attacker to reset admin password without valid reset token

Quick fix

GHSA-6xc2-mj39-q599 — strapi: upgrade to the fixed version with the command below.

npm install strapi@3.0.0-beta.17.5

Details

Versions of `strapi` prior to 3.0.0-beta.17.5 are vulnerable to Privilege Escalation. The password reset routes allows an unauthenticated attacker to reset an admin's password without providing a valid password reset token.

## Recommendation

Upgrade to version 3.0.0-beta.17.5 or later.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/strapi

Introduced in: 0Fixed in: 3.0.0-beta.17.5

Fixnpm install strapi@3.0.0-beta.17.5

References

https://nvd.nist.gov/vuln/detail/CVE-2019-18818[ADVISORY]
https://github.com/strapi/strapi/pull/4443[WEB]
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18818[WEB]
https://github.com/strapi/strapi[PACKAGE]
https://github.com/strapi/strapi/releases/tag/v3.0.0-beta.17.5[WEB]
https://www.npmjs.com/advisories/1311[WEB]
http://packetstormsecurity.com/files/163939/Strapi-3.0.0-beta-Authentication-Bypass.html[WEB]
http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html[WEB]
http://packetstormsecurity.com/files/165896/Strapi-CMS-3.0.0-beta.17.4-Privilege-Escalation.html[WEB]