CVE-2019-18818 : strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.

Published 2019-11-07 22:15:11

Updated 2022-02-20 06:22:30

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2019-18818

Strapi » Strapi
Versions up to, including, (<=) 1.6.4
cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha10.1
cpe:2.3:a:strapi:strapi:3.0.0:alpha10.1:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha10.2
cpe:2.3:a:strapi:strapi:3.0.0:alpha10.2:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha10.3
cpe:2.3:a:strapi:strapi:3.0.0:alpha10.3:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha11
cpe:2.3:a:strapi:strapi:3.0.0:alpha11:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha11.1
cpe:2.3:a:strapi:strapi:3.0.0:alpha11.1:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha11.2
cpe:2.3:a:strapi:strapi:3.0.0:alpha11.2:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha11.3
cpe:2.3:a:strapi:strapi:3.0.0:alpha11.3:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha12
cpe:2.3:a:strapi:strapi:3.0.0:alpha12:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha12.1
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha12.1.3
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1.3:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha12.2
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.2:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha12.3
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.3:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha12.4
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.4:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha12.5
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.5:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha12.6
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.6:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha12.7
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha12.7.1
cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7.1:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha13
cpe:2.3:a:strapi:strapi:3.0.0:alpha13:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha13.0.1
cpe:2.3:a:strapi:strapi:3.0.0:alpha13.0.1:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha13.1
cpe:2.3:a:strapi:strapi:3.0.0:alpha13.1:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha14
cpe:2.3:a:strapi:strapi:3.0.0:alpha14:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha14.1
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha14.1.1
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1.1:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha14.2
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.2:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha14.3
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.3:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha14.4.0
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.4.0:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha14.5
cpe:2.3:a:strapi:strapi:3.0.0:alpha14.5:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha15
cpe:2.3:a:strapi:strapi:3.0.0:alpha15:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha16
cpe:2.3:a:strapi:strapi:3.0.0:alpha16:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha17
cpe:2.3:a:strapi:strapi:3.0.0:alpha17:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha18
cpe:2.3:a:strapi:strapi:3.0.0:alpha18:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha19
cpe:2.3:a:strapi:strapi:3.0.0:alpha19:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha20
cpe:2.3:a:strapi:strapi:3.0.0:alpha20:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha21
cpe:2.3:a:strapi:strapi:3.0.0:alpha21:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha22
cpe:2.3:a:strapi:strapi:3.0.0:alpha22:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha23
cpe:2.3:a:strapi:strapi:3.0.0:alpha23:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha23.1
cpe:2.3:a:strapi:strapi:3.0.0:alpha23.1:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha24
cpe:2.3:a:strapi:strapi:3.0.0:alpha24:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha24.1
cpe:2.3:a:strapi:strapi:3.0.0:alpha24.1:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha25
cpe:2.3:a:strapi:strapi:3.0.0:alpha25:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha25.1
cpe:2.3:a:strapi:strapi:3.0.0:alpha25.1:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha25.2
cpe:2.3:a:strapi:strapi:3.0.0:alpha25.2:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha26
cpe:2.3:a:strapi:strapi:3.0.0:alpha26:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha26.1
cpe:2.3:a:strapi:strapi:3.0.0:alpha26.1:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha26.2
cpe:2.3:a:strapi:strapi:3.0.0:alpha26.2:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha4
cpe:2.3:a:strapi:strapi:3.0.0:alpha4:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha4.8
cpe:2.3:a:strapi:strapi:3.0.0:alpha4.8:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha5.3
cpe:2.3:a:strapi:strapi:3.0.0:alpha5.3:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha5.5
cpe:2.3:a:strapi:strapi:3.0.0:alpha5.5:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha6.3
cpe:2.3:a:strapi:strapi:3.0.0:alpha6.3:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha6.4
cpe:2.3:a:strapi:strapi:3.0.0:alpha6.4:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha6.7
cpe:2.3:a:strapi:strapi:3.0.0:alpha6.7:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha7.2
cpe:2.3:a:strapi:strapi:3.0.0:alpha7.2:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha7.3
cpe:2.3:a:strapi:strapi:3.0.0:alpha7.3:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha8
cpe:2.3:a:strapi:strapi:3.0.0:alpha8:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha8.3
cpe:2.3:a:strapi:strapi:3.0.0:alpha8.3:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha9
cpe:2.3:a:strapi:strapi:3.0.0:alpha9:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha9.1
cpe:2.3:a:strapi:strapi:3.0.0:alpha9.1:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Alpha9.2
cpe:2.3:a:strapi:strapi:3.0.0:alpha9.2:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta0
cpe:2.3:a:strapi:strapi:3.0.0:beta0:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta1
cpe:2.3:a:strapi:strapi:3.0.0:beta1:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta10
cpe:2.3:a:strapi:strapi:3.0.0:beta10:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta11
cpe:2.3:a:strapi:strapi:3.0.0:beta11:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta12
cpe:2.3:a:strapi:strapi:3.0.0:beta12:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta13
cpe:2.3:a:strapi:strapi:3.0.0:beta13:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta14
cpe:2.3:a:strapi:strapi:3.0.0:beta14:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta15
cpe:2.3:a:strapi:strapi:3.0.0:beta15:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta16
cpe:2.3:a:strapi:strapi:3.0.0:beta16:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta16.1
cpe:2.3:a:strapi:strapi:3.0.0:beta16.1:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta16.2
cpe:2.3:a:strapi:strapi:3.0.0:beta16.2:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta16.3
cpe:2.3:a:strapi:strapi:3.0.0:beta16.3:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta16.4
cpe:2.3:a:strapi:strapi:3.0.0:beta16.4:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta16.5
cpe:2.3:a:strapi:strapi:3.0.0:beta16.5:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta16.6
cpe:2.3:a:strapi:strapi:3.0.0:beta16.6:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta16.7
cpe:2.3:a:strapi:strapi:3.0.0:beta16.7:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta16.8
cpe:2.3:a:strapi:strapi:3.0.0:beta16.8:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta17
cpe:2.3:a:strapi:strapi:3.0.0:beta17:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta17.1
cpe:2.3:a:strapi:strapi:3.0.0:beta17.1:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta17.2
cpe:2.3:a:strapi:strapi:3.0.0:beta17.2:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta17.3
cpe:2.3:a:strapi:strapi:3.0.0:beta17.3:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta17.4
cpe:2.3:a:strapi:strapi:3.0.0:beta17.4:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta2
cpe:2.3:a:strapi:strapi:3.0.0:beta2:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta3
cpe:2.3:a:strapi:strapi:3.0.0:beta3:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta4
cpe:2.3:a:strapi:strapi:3.0.0:beta4:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta5
cpe:2.3:a:strapi:strapi:3.0.0:beta5:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta6
cpe:2.3:a:strapi:strapi:3.0.0:beta6:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta7
cpe:2.3:a:strapi:strapi:3.0.0:beta7:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta8
cpe:2.3:a:strapi:strapi:3.0.0:beta8:*:*:*:*:*:*
Matching versions
Strapi » Strapi » Version: 3.0.0 Update Beta9
cpe:2.3:a:strapi:strapi:3.0.0:beta9:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2019-18818

EPSS FAQ

94.01%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 100 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2019-18818

Strapi CMS Unauthenticated Password Reset

Disclosure Date: 2022-02-09

First seen: 2024-11-22

auxiliary/scanner/http/strapi_3_password_reset

This module abuses the mishandling of a password reset request for Strapi CMS version 3.0.0-beta.17.4 to change the password of the admin user. Successfully tested against Strapi CMS version 3.0.0-beta.17.4. Authors: - WackyH4cker - h00die

More information

CVSS scores for CVE-2019-18818

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-18818

CWE-640 Weak Password Recovery Mechanism for Forgotten Password

The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-18818

http://packetstormsecurity.com/files/163939/Strapi-3.0.0-beta-Authentication-Bypass.html

Strapi 3.0.0-beta Authentication Bypass ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
http://packetstormsecurity.com/files/165896/Strapi-CMS-3.0.0-beta.17.4-Privilege-Escalation.html

Strapi CMS 3.0.0-beta.17.4 Privilege Escalation ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
https://github.com/strapi/strapi/pull/4443

Fix security issue with reset password by alexandrebodin · Pull Request #4443 · strapi/strapi · GitHub
Third Party Advisory
https://github.com/strapi/strapi/releases/tag/v3.0.0-beta.17.5

Release v3.0.0-beta.17.5 · strapi/strapi · GitHub
Release Notes;Third Party Advisory
https://www.npmjs.com/advisories/1311

npm
Third Party Advisory
http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html

Strapi CMS 3.0.0-beta.17.4 Remote Code Execution ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry

CVEs referencing this url

Jump to