CVE-2019-18818
- Source
- https://cve.org/CVERecord?id=CVE-2019-18818
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-18818.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2019-18818
- Aliases
- Published
- 2019-11-07T22:15:10.570Z
- Modified
- 2026-07-08T05:56:04.402101807Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.
- Database specific
{ "unresolved_ranges": [ { "cpes": [ "cpe:2.3:a:strapi:strapi:3.0.0:alpha10.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha10.2:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha10.3:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha11.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha11.2:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha11.3:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha11:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1.3:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha12.2:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha12.3:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha12.4:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha12.5:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha12.6:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha12:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha13.0.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha13.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha13:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha14.2:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha14.3:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha14.4.0:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha14.5:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha14:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha15:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha16:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha17:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha18:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha19:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha20:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha21:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha22:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha23.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha23:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha24.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha24:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha25.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha25.2:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha25:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha26.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha26.2:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha26:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha4.8:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha4:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha5.3:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha5.5:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha6.3:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha6.4:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha6.7:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha7.2:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha7.3:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha8.3:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha8:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha9.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha9.2:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha9:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta0:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta10:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta11:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta12:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta13:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta14:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta15:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta16.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta16.2:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta16.3:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta16.4:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta16.5:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta16.6:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta16.7:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta16.8:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta16:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta17.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta17.2:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta17.3:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta17.4:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta17:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta2:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta3:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta4:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta5:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta6:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta7:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta8:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta9:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "3.0.0-alpha10\\.1" }, { "last_affected": "3.0.0-alpha10\\.1" }, { "introduced": "3.0.0-alpha10\\.2" }, { "last_affected": "3.0.0-alpha10\\.2" }, { "introduced": "3.0.0-alpha10\\.3" }, { "last_affected": "3.0.0-alpha10\\.3" }, { "introduced": "3.0.0-alpha11" }, { "last_affected": "3.0.0-alpha11" }, { "introduced": "3.0.0-alpha11\\.1" }, { "last_affected": "3.0.0-alpha11\\.1" }, { "introduced": "3.0.0-alpha11\\.2" }, { "last_affected": "3.0.0-alpha11\\.2" }, { "introduced": "3.0.0-alpha11\\.3" }, { "last_affected": "3.0.0-alpha11\\.3" }, { "introduced": "3.0.0-alpha12" }, { "last_affected": "3.0.0-alpha12" }, { "introduced": "3.0.0-alpha12\\.1" }, { "last_affected": "3.0.0-alpha12\\.1" }, { "introduced": "3.0.0-alpha12\\.1\\.3" }, { "last_affected": "3.0.0-alpha12\\.1\\.3" }, { "introduced": "3.0.0-alpha12\\.2" }, { "last_affected": "3.0.0-alpha12\\.2" }, { "introduced": "3.0.0-alpha12\\.3" }, { "last_affected": "3.0.0-alpha12\\.3" }, { "introduced": "3.0.0-alpha12\\.4" }, { "last_affected": "3.0.0-alpha12\\.4" }, { "introduced": "3.0.0-alpha12\\.5" }, { "last_affected": "3.0.0-alpha12\\.5" }, { "introduced": "3.0.0-alpha12\\.6" }, { "last_affected": "3.0.0-alpha12\\.6" }, { "introduced": "3.0.0-alpha12\\.7" }, { "last_affected": "3.0.0-alpha12\\.7" }, { "introduced": "3.0.0-alpha12\\.7\\.1" }, { "last_affected": "3.0.0-alpha12\\.7\\.1" }, { "introduced": "3.0.0-alpha13" }, { "last_affected": "3.0.0-alpha13" }, { "introduced": "3.0.0-alpha13\\.0\\.1" }, { "last_affected": "3.0.0-alpha13\\.0\\.1" }, { "introduced": "3.0.0-alpha13\\.1" }, { "last_affected": "3.0.0-alpha13\\.1" }, { "introduced": "3.0.0-alpha14" }, { "last_affected": "3.0.0-alpha14" }, { "introduced": "3.0.0-alpha14\\.1" }, { "last_affected": "3.0.0-alpha14\\.1" }, { "introduced": "3.0.0-alpha14\\.1\\.1" }, { "last_affected": "3.0.0-alpha14\\.1\\.1" }, { "introduced": "3.0.0-alpha14\\.2" }, { "last_affected": "3.0.0-alpha14\\.2" }, { "introduced": "3.0.0-alpha14\\.3" }, { "last_affected": "3.0.0-alpha14\\.3" }, { "introduced": "3.0.0-alpha14\\.4\\.0" }, { "last_affected": "3.0.0-alpha14\\.4\\.0" }, { "introduced": "3.0.0-alpha14\\.5" }, { "last_affected": "3.0.0-alpha14\\.5" }, { "introduced": "3.0.0-alpha15" }, { "last_affected": "3.0.0-alpha15" }, { "introduced": "3.0.0-alpha16" }, { "last_affected": "3.0.0-alpha16" }, { "introduced": "3.0.0-alpha17" }, { "last_affected": "3.0.0-alpha17" }, { "introduced": "3.0.0-alpha18" }, { "last_affected": "3.0.0-alpha18" }, { "introduced": "3.0.0-alpha19" }, { "last_affected": "3.0.0-alpha19" }, { "introduced": "3.0.0-alpha20" }, { "last_affected": "3.0.0-alpha20" }, { "introduced": "3.0.0-alpha21" }, { "last_affected": "3.0.0-alpha21" }, { "introduced": "3.0.0-alpha22" }, { "last_affected": "3.0.0-alpha22" }, { "introduced": "3.0.0-alpha23" }, { "last_affected": "3.0.0-alpha23" }, { "introduced": "3.0.0-alpha23\\.1" }, { "last_affected": "3.0.0-alpha23\\.1" }, { "introduced": "3.0.0-alpha24" }, { "last_affected": "3.0.0-alpha24" }, { "introduced": "3.0.0-alpha24\\.1" }, { "last_affected": "3.0.0-alpha24\\.1" }, { "introduced": "3.0.0-alpha25" }, { "last_affected": "3.0.0-alpha25" }, { "introduced": "3.0.0-alpha25\\.1" }, { "last_affected": "3.0.0-alpha25\\.1" }, { "introduced": "3.0.0-alpha25\\.2" }, { "last_affected": "3.0.0-alpha25\\.2" }, { "introduced": "3.0.0-alpha26" }, { "last_affected": "3.0.0-alpha26" }, { "introduced": "3.0.0-alpha26\\.1" }, { "last_affected": "3.0.0-alpha26\\.1" }, { "introduced": "3.0.0-alpha26\\.2" }, { "last_affected": "3.0.0-alpha26\\.2" }, { "introduced": "3.0.0-alpha4" }, { "last_affected": "3.0.0-alpha4" }, { "introduced": "3.0.0-alpha4\\.8" }, { "last_affected": "3.0.0-alpha4\\.8" }, { "introduced": "3.0.0-alpha5\\.3" }, { "last_affected": "3.0.0-alpha5\\.3" }, { "introduced": "3.0.0-alpha5\\.5" }, { "last_affected": "3.0.0-alpha5\\.5" }, { "introduced": "3.0.0-alpha6\\.3" }, { "last_affected": "3.0.0-alpha6\\.3" }, { "introduced": "3.0.0-alpha6\\.4" }, { "last_affected": "3.0.0-alpha6\\.4" }, { "introduced": "3.0.0-alpha6\\.7" }, { "last_affected": "3.0.0-alpha6\\.7" }, { "introduced": "3.0.0-alpha7\\.2" }, { "last_affected": "3.0.0-alpha7\\.2" }, { "introduced": "3.0.0-alpha7\\.3" }, { "last_affected": "3.0.0-alpha7\\.3" }, { "introduced": "3.0.0-alpha8" }, { "last_affected": "3.0.0-alpha8" }, { "introduced": "3.0.0-alpha8\\.3" }, { "last_affected": "3.0.0-alpha8\\.3" }, { "introduced": "3.0.0-alpha9" }, { "last_affected": "3.0.0-alpha9" }, { "introduced": "3.0.0-alpha9\\.1" }, { "last_affected": "3.0.0-alpha9\\.1" }, { "introduced": "3.0.0-alpha9\\.2" }, { "last_affected": "3.0.0-alpha9\\.2" }, { "introduced": "3.0.0-beta0" }, { "last_affected": "3.0.0-beta0" }, { "introduced": "3.0.0-beta1" }, { "last_affected": "3.0.0-beta1" }, { "introduced": "3.0.0-beta10" }, { "last_affected": "3.0.0-beta10" }, { "introduced": "3.0.0-beta11" }, { "last_affected": "3.0.0-beta11" }, { "introduced": "3.0.0-beta12" }, { "last_affected": "3.0.0-beta12" }, { "introduced": "3.0.0-beta13" }, { "last_affected": "3.0.0-beta13" }, { "introduced": "3.0.0-beta14" }, { "last_affected": "3.0.0-beta14" }, { "introduced": "3.0.0-beta15" }, { "last_affected": "3.0.0-beta15" }, { "introduced": "3.0.0-beta16" }, { "last_affected": "3.0.0-beta16" }, { "introduced": "3.0.0-beta16\\.1" }, { "last_affected": "3.0.0-beta16\\.1" }, { "introduced": "3.0.0-beta16\\.2" }, { "last_affected": "3.0.0-beta16\\.2" }, { "introduced": "3.0.0-beta16\\.3" }, { "last_affected": "3.0.0-beta16\\.3" }, { "introduced": "3.0.0-beta16\\.4" }, { "last_affected": "3.0.0-beta16\\.4" }, { "introduced": "3.0.0-beta16\\.5" }, { "last_affected": "3.0.0-beta16\\.5" }, { "introduced": "3.0.0-beta16\\.6" }, { "last_affected": "3.0.0-beta16\\.6" }, { "introduced": "3.0.0-beta16\\.7" }, { "last_affected": "3.0.0-beta16\\.7" }, { "introduced": "3.0.0-beta16\\.8" }, { "last_affected": "3.0.0-beta16\\.8" }, { "introduced": "3.0.0-beta17" }, { "last_affected": "3.0.0-beta17" }, { "introduced": "3.0.0-beta17\\.1" }, { "last_affected": "3.0.0-beta17\\.1" }, { "introduced": "3.0.0-beta17\\.2" }, { "last_affected": "3.0.0-beta17\\.2" }, { "introduced": "3.0.0-beta17\\.3" }, { "last_affected": "3.0.0-beta17\\.3" }, { "introduced": "3.0.0-beta17\\.4" }, { "last_affected": "3.0.0-beta17\\.4" }, { "introduced": "3.0.0-beta2" }, { "last_affected": "3.0.0-beta2" }, { "introduced": "3.0.0-beta3" }, { "last_affected": "3.0.0-beta3" }, { "introduced": "3.0.0-beta4" }, { "last_affected": "3.0.0-beta4" }, { "introduced": "3.0.0-beta5" }, { "last_affected": "3.0.0-beta5" }, { "introduced": "3.0.0-beta6" }, { "last_affected": "3.0.0-beta6" }, { "introduced": "3.0.0-beta7" }, { "last_affected": "3.0.0-beta7" }, { "introduced": "3.0.0-beta8" }, { "last_affected": "3.0.0-beta8" }, { "introduced": "3.0.0-beta9" }, { "last_affected": "3.0.0-beta9" } ], "source": "CPE_STRING", "vendor_product": "strapi:strapi" } ] }- References
-
- https://github.com/strapi/strapi/pull/4443
- https://github.com/strapi/strapi/releases/tag/v3.0.0-beta.17.5
- https://www.npmjs.com/advisories/1311
- http://packetstormsecurity.com/files/163939/Strapi-3.0.0-beta-Authentication-Bypass.html
- http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/165896/Strapi-CMS-3.0.0-beta.17.4-Privilege-Escalation.html
Affected packages
Git / github.com/strapi/strapi
Affected ranges
- Type
- GIT
- Repo
- https://github.com/strapi/strapi
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affectedFixed
- Database specific
{ "extracted_events": [ { "introduced": "0" }, { "last_affected": "1.6.4" } ], "cpe": "cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*", "source": [ "CPE_RANGE", "REFERENCES" ] }
Affected versions
v1.*
v1.0.0
v1.0.1
v1.0.5
v1.0.6
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.5.0
v1.5.1
v1.5.2
v1.5.3
v1.5.4
v1.5.7
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v3.*
v3.0.0-alpha.12.7
v3.0.0-alpha.12.7.1
v3.0.0-alpha.13
v3.0.0-alpha.23.1
v3.0.0-alpha.4
v3.0.0-alpha.4.8
v3.0.0-alpha.6.4
v3.0.0-alpha.6.7
v3.0.0-alpha.7.3
v3.0.0-alpha.9
v3.0.0-beta.0
v3.0.0-beta.1
v3.0.0-beta.10
v3.0.0-beta.11
v3.0.0-beta.12
v3.0.0-beta.13
v3.0.0-beta.14
v3.0.0-beta.15
v3.0.0-beta.16
v3.0.0-beta.16.1
v3.0.0-beta.16.2
v3.0.0-beta.16.3
v3.0.0-beta.16.4
v3.0.0-beta.16.5
v3.0.0-beta.16.6
v3.0.0-beta.16.7
v3.0.0-beta.16.8
v3.0.0-beta.17
v3.0.0-beta.17.1
v3.0.0-beta.17.2
v3.0.0-beta.17.4
v3.0.0-beta.2
v3.0.0-beta.3
v3.0.0-beta.4
v3.0.0-beta.5
v3.0.0-beta.6
v3.0.0-beta.7
v3.0.0-beta.8
v3.0.0-beta.9