Description

An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file.

Remediation

References

https://github.com/strapi/strapi

https://www.youtube.com/watch?v=LEeabouqRrg

Related Vulnerabilities

CVE-2021-27578 Vulnerability in maven package org.apache.zeppelin:zeppelin

CVE-2019-1003055 Vulnerability in maven package org.jvnet.hudson.plugins:ftppublisher

CVE-2021-23797 Vulnerability in npm package http-server-node

CVE-2020-8176 Vulnerability in npm package koa-shopify-auth

CVE-2016-10633 Vulnerability in npm package dwebp-bin

Severity

Critical

Classification

CWE-434 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory Exploit