What is GHSA-mcqm-6ff4-53qx?

GHSA-mcqm-6ff4-53qx is a security advisory published by GitHub Security Advisories with Medium severity. Cross-site Scripting in Strapi

Which CVE IDs does GHSA-mcqm-6ff4-53qx cover?

GHSA-mcqm-6ff4-53qx covers the following CVE IDs: CVE-2022-29894. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mcqm-6ff4-53qx?

GHSA-mcqm-6ff4-53qx has a CVSS v3 base score of 4.8, published by GitHub Security Advisories.

Which products are affected by GHSA-mcqm-6ff4-53qx?

GHSA-mcqm-6ff4-53qx affects 1 product, including: npm/strapi:\u003c= 3.6.10.

GHSA-mcqm-6ff4-53qxMediumCVSS 4.8

Cross-site Scripting in Strapi

Vendor

GitHub Security Advisories

Published

June 14, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-29894 →

📋 Description

Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege.

🎯 Affected products1

npm/strapi:<= 3.6.10

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2022-29894
https://github.com/strapi/strapi
https://jvn.jp/en/jp/JVN44550983/index.html
https://strapi.io/
https://github.com/advisories/GHSA-mcqm-6ff4-53qx