GHSA-mcqm-6ff4-53qx

Cross-site Scripting in Strapi

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-29894

Packages

Ecosystem	Package	Affected	Fixed in
npm	strapi	<= 3.6.10	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-29894 advisory
https://github.com/strapi/strapi package
https://jvn.jp/en/jp/JVN44550983/index.html web
https://strapi.io web