Description
Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a victim’s HTTP request. From this, the attacker can get the victim’s cookie, base64 decode it, and obtain a cleartext password, leading to getting API documentation for further API attacks.
Recommendation
Update the @strapi/strapi package to the latest compatible version. Followings are version details:
- Affected version(s): >= 4.0.0, < 4.1.5
- Patched version(s): 4.1.5
References
- GHSA-85vg-grr5-pw42
- hub.docker.com
- strapi.io
- packetstormsecurity.com
- CVE-2021-46440
- CWE-922
- CAPEC-310
- OWASP 2021-A1
- OWASP 2021-A6
Related Issues
- Insecure template handling in haml-coffee - CVE-2021-32818
- Insecure template handling in Squirrelly - CVE-2021-32819
- Insecure random number generation in keypair - CVE-2021-41117
- Strapi mishandles hidden attributes within admin API responses - CVE-2022-31367
- Tags:
- npm
- @strapi/strapi
Anything's wrong? Let us know Last updated on February 01, 2023