Description
Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a victim’s HTTP request. From this, the attacker can get the victim’s cookie, base64 decode it, and obtain a cleartext password, leading to getting API documentation for further API attacks.
Recommendation
Update the @strapi/strapi package to the latest compatible version. Followings are version details:
- Affected version(s): >= 4.0.0, < 4.1.5
- Patched version(s): 4.1.5
References
- GHSA-85vg-grr5-pw42
- hub.docker.com
- strapi.io
- packetstormsecurity.com
- CVE-2021-46440
- CWE-922
- CAPEC-310
- OWASP 2021-A1
- OWASP 2021-A6
Related Issues
- Atro CSRF Middleware Bypass (security.checkOrigin) - CVE-2024-56140
- Strapi is vulnerable to Insufficient Session Expiration - CVE-2025-3930
- SillyTavern Web Interface Vulnerable DNS Rebinding - CVE-2025-59159
- Prototype Pollution in lodash (GHSA-p6mc-m468-83gw) - CVE-2020-8203
- Tags:
- npm
- @strapi/strapi
Anything's wrong? Let us know Last updated on February 01, 2023