Description
Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a victim’s HTTP request. From this, the attacker can get the victim’s cookie, base64 decode it, and obtain a cleartext password, leading to getting API documentation for further API attacks.
Recommendation
Update the @strapi/strapi package to the latest compatible version. Followings are version details:
- Affected version(s): >= 4.0.0, < 4.1.5
- Patched version(s): 4.1.5
References
- GHSA-85vg-grr5-pw42
- hub.docker.com
- strapi.io
- packetstormsecurity.com
- CVE-2021-46440
- CWE-922
- CAPEC-310
- OWASP 2021-A1
- OWASP 2021-A6
Related Issues
- Prototype Pollution in lodash (GHSA-p6mc-m468-83gw) - CVE-2020-8203
- Cross-site Scripting (XSS) in serialize-javascript - CVE-2024-11831
- QMarkdown Cross-Site Scripting (XSS) vulnerability - CVE-2025-43954
- MathLive's Lack of Escaping of HTML allows for XSS - CVE-2025-29049
- Tags:
- npm
- @strapi/strapi
Anything's wrong? Let us know Last updated on February 01, 2023