CVE-2019-18818

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 97.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-11-07 · updated 2026-06-17
Weakness: CWE-640

Description

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.

Affected products

strapi: through 1.6.4; 3.0.0-alpha10.1, 3.0.0-alpha10.2, 3.0.0-alpha10.3, 3.0.0-alpha11, 3.0.0-alpha11.1, 3.0.0-alpha11.2 (+83)

References

http://packetstormsecurity.com/files/163939/Strapi-3.0.0-beta-Authentication-Bypass.html
http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165896/Strapi-CMS-3.0.0-beta.17.4-Privilege-Escalation.html
https://github.com/strapi/strapi/pull/4443
https://github.com/strapi/strapi/releases/tag/v3.0.0-beta.17.5
https://www.npmjs.com/advisories/1311
http://packetstormsecurity.com/files/163939/Strapi-3.0.0-beta-Authentication-Bypass.html
http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html
http://packetstormsecurity.com/files/165896/Strapi-CMS-3.0.0-beta.17.4-Privilege-Escalation.html
https://github.com/strapi/strapi/pull/4443
https://github.com/strapi/strapi/releases/tag/v3.0.0-beta.17.5
https://www.npmjs.com/advisories/1311

Get alerted when CVE-2019-18818 or the next vulnerability affects your stack