CVE-2019-18818

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-18818
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://packetstormsecurity.com/files/163939/Strapi-3.0.0-beta-Authentication-Bypass.html Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/165896/Strapi-CMS-3.0.0-beta.17.4-Privilege-Escalation.html Exploit Third Party Advisory VDB Entry
https://github.com/strapi/strapi/pull/4443 Third Party Advisory
https://github.com/strapi/strapi/releases/tag/v3.0.0-beta.17.5 Release Notes Third Party Advisory
https://www.npmjs.com/advisories/1311 Third Party Advisory
http://packetstormsecurity.com/files/163939/Strapi-3.0.0-beta-Authentication-Bypass.html Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html Exploit Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/165896/Strapi-CMS-3.0.0-beta.17.4-Privilege-Escalation.html Exploit Third Party Advisory VDB Entry
https://github.com/strapi/strapi/pull/4443 Third Party Advisory
https://github.com/strapi/strapi/releases/tag/v3.0.0-beta.17.5 Release Notes Third Party Advisory
https://www.npmjs.com/advisories/1311 Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha10.1:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha10.2:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha10.3:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha11:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha11.1:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha11.2:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha11.3:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha12:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1.3:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.2:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.3:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.4:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.5:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.6:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7.1:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha13:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha13.0.1:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha13.1:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha14:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1.1:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.2:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.3:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.4.0:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.5:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha15:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha16:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha17:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha18:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha19:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha20:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha21:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha22:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha23:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha23.1:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha24:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha24.1:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha25:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha25.1:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha25.2:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha26:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha26.1:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha26.2:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha4:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha4.8:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha5.3:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha5.5:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha6.3:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha6.4:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha6.7:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha7.2:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha7.3:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha8:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha8.3:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha9:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha9.1:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:alpha9.2:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta0:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta10:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta11:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta12:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta13:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta14:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta15:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta16:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta16.1:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta16.2:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta16.3:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta16.4:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta16.5:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta16.6:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta16.7:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta16.8:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta17:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta17.1:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta17.2:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta17.3:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta17.4:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta2:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta3:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta4:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta5:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta6:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta7:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta8:*:*:*:*:*:*
cpe:2.3:a:strapi:strapi:3.0.0:beta9:*:*:*:*:*:*
History

21 Nov 2024, 04:33

Type Values Removed Values Added
References () http://packetstormsecurity.com/files/163939/Strapi-3.0.0-beta-Authentication-Bypass.html - Exploit, Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/163939/Strapi-3.0.0-beta-Authentication-Bypass.html - Exploit, Third Party Advisory, VDB Entry
References () http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry
References () http://packetstormsecurity.com/files/165896/Strapi-CMS-3.0.0-beta.17.4-Privilege-Escalation.html - Exploit, Third Party Advisory, VDB Entry () http://packetstormsecurity.com/files/165896/Strapi-CMS-3.0.0-beta.17.4-Privilege-Escalation.html - Exploit, Third Party Advisory, VDB Entry
References () https://github.com/strapi/strapi/pull/4443 - Third Party Advisory () https://github.com/strapi/strapi/pull/4443 - Third Party Advisory
References () https://github.com/strapi/strapi/releases/tag/v3.0.0-beta.17.5 - Release Notes, Third Party Advisory () https://github.com/strapi/strapi/releases/tag/v3.0.0-beta.17.5 - Release Notes, Third Party Advisory
References () https://www.npmjs.com/advisories/1311 - Third Party Advisory () https://www.npmjs.com/advisories/1311 - Third Party Advisory

20 Feb 2022, 06:22

Type Values Removed Values Added
CVSS v2 : 5.0
v3 : 9.8 		v2 : 7.5
v3 : 9.8
References (MISC) http://packetstormsecurity.com/files/165896/Strapi-CMS-3.0.0-beta.17.4-Privilege-Escalation.html - (MISC) http://packetstormsecurity.com/files/165896/Strapi-CMS-3.0.0-beta.17.4-Privilege-Escalation.html - Exploit, Third Party Advisory, VDB Entry

08 Feb 2022, 19:15

Type Values Removed Values Added
References
  • (MISC) http://packetstormsecurity.com/files/165896/Strapi-CMS-3.0.0-beta.17.4-Privilege-Escalation.html -

14 Sep 2021, 12:04

Type Values Removed Values Added
References (MISC) http://packetstormsecurity.com/files/163939/Strapi-3.0.0-beta-Authentication-Bypass.html - (MISC) http://packetstormsecurity.com/files/163939/Strapi-3.0.0-beta-Authentication-Bypass.html - Exploit, Third Party Advisory, VDB Entry
References (MISC) http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html - (MISC) http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry

31 Aug 2021, 17:15

Type Values Removed Values Added
References
  • (MISC) http://packetstormsecurity.com/files/163939/Strapi-3.0.0-beta-Authentication-Bypass.html -
  • (MISC) http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html -
Information

Published : 2019-11-07 22:15

Updated : 2024-11-21 04:33

NVD link : CVE-2019-18818

Mitre link : CVE-2019-18818

CVE.ORG link : CVE-2019-18818

JSON object : View

Products Affected

strapi

  • strapi
CWE
CWE-640

Weak Password Recovery Mechanism for Forgotten Password