GHSA-mcqm-6ff4-53qx

Suggest an improvement
Source
https://github.com/advisories/GHSA-mcqm-6ff4-53qx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-mcqm-6ff4-53qx/GHSA-mcqm-6ff4-53qx.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-mcqm-6ff4-53qx
Aliases
Published
2022-06-14T00:00:38Z
Modified
2023-11-08T04:09:15.421767Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Cross-site Scripting in Strapi
Details

Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege.

Database specific
{
    "nvd_published_at": "2022-06-13T05:15:00Z",
    "severity": "MODERATE",
    "github_reviewed_at": "2022-06-24T00:53:31Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

npm / strapi

Package

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
3.6.10