Description
An unrestricted file upload vulnerability in the Add New Assets function of Strapi v4.1.12 allows attackers to execute arbitrary code via a crafted file. After an authenticated attacker uploads a file containing a malicious URL, a victim copies and pastes the malicious URL into a new tab to receive the XSS payload.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 4.1.12
References
Could your website be exposed too?
SmartScanner can check your website for Strapi 4.1.12 Cross-site Scripting via crafted file and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details - CVE-2022-39350
- wangEditor was discovered to contain a cross-site scripting (XSS) vulnerability via the image upload function - CVE-2022-25037
- Cross-site Scripting in CKEditor4 - CVE-2022-24728
- Reflected cross-site scripting (XSS) vulnerability - CVE-2022-0087
You might also like:
See something that needs correcting? Let us knowUpdated March 21, 2024