Description

Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature.

Remediation

References

https://github.com/strapi/strapi/pull/8440

https://github.com/strapi/strapi/releases/tag/v3.2.5

Related Vulnerabilities

CVE-2023-1108 Vulnerability in maven package io.undertow:undertow-core

CVE-2020-17479 Vulnerability in npm package jpv

CVE-2018-1305 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core

CVE-2022-45143 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core

CVE-2018-3786 Vulnerability in npm package egg-scripts

Severity

Medium

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Patch Third Party Advisory Release Notes