CVE-2019-18818
Summary
| CVE | CVE-2019-18818 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-11-07 22:15:00 UTC |
| Updated | 2022-02-20 06:22:00 UTC |
| Description | strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js. |
Risk And Classification
Problem Types: CWE-640
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Strapi | Strapi | 3.0.0 | alpha10.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha10.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha10.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha11 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha11.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha11.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha11.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.1.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.4 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.5 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.6 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.7 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.7.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha13 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha13.0.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha13.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14.1.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14.4.0 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14.5 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha15 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha16 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha17 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha18 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha19 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha20 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha21 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha22 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha23 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha23.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha24 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha24.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha25 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha25.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha25.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha26 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha26.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha26.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha4 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha4.8 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha5.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha5.5 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha6.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha6.4 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha6.7 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha7.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha7.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha8 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha8.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha9 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha9.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha9.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta0 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta10 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta11 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta12 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta13 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta14 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta15 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.4 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.5 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.6 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.7 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.8 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17.4 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta4 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta5 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta6 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta7 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta8 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta9 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha10.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha10.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha10.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha11 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha11.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha11.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha11.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.1.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.4 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.5 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.6 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.7 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha12.7.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha13 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha13.0.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha13.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14.1.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14.4.0 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha14.5 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha15 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha16 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha17 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha18 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha19 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha20 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha21 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha22 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha23 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha23.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha24 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha24.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha25 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha25.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha25.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha26 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha26.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha26.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha4 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha4.8 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha5.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha5.5 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha6.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha6.4 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha6.7 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha7.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha7.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha8 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha8.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha9 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha9.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | alpha9.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta0 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta10 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta11 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta12 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta13 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta14 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta15 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.4 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.5 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.6 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.7 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta16.8 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17.1 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17.2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17.3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta17.4 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta2 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta3 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta4 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta5 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta6 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta7 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta8 | All | All |
| Application | Strapi | Strapi | 3.0.0 | beta9 | All | All |
| Application | Strapi | Strapi | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Strapi 3.0.0-beta Authentication Bypass ≈ Packet Storm | MISC | packetstormsecurity.com | |
| Strapi CMS 3.0.0-beta.17.4 Remote Code Execution ≈ Packet Storm | MISC | packetstormsecurity.com | |
| Overview | MISC | www.npmjs.com | Third Party Advisory |
| Release v3.0.0-beta.17.5 · strapi/strapi · GitHub | MISC | github.com | Release Notes, Third Party Advisory |
| Fix security issue with reset password by alexandrebodin · Pull Request #4443 · strapi/strapi · GitHub | MISC | github.com | Third Party Advisory |
| Strapi CMS 3.0.0-beta.17.4 Privilege Escalation ≈ Packet Storm | MISC | packetstormsecurity.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 981299 Nodejs (npm) Security Update for strapi (GHSA-6xc2-mj39-q599)