~ / search / GHSA-7frv-9phw-vrvr

GHSA-7frv-9phw-vrvr

Authorization bypass in Strapi

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-27664

Packages

EcosystemPackageAffectedFixed in
npm strapi < 3.2.5 3.2.5

Details

As written in the advisory (Markdown source, shown as plain text).

`admin/src/containers/InputModalStepperProvider/index.js` in Strapi before 3.2.5 has unwanted `/proxy?url=` functionality.

References

External links from the advisory. They lead to third-party sites.