CVE-2021-28128

Katalog CVE

CVSS 8.1 · High EPSS 1,3%

Kerentanan Weak Password Recovery Mechanism for Forgotten Password pada strapi. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password.

Rincian

Terbit di NVD

6 Mei 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-640: Weak Password Recovery Mechanism for Forgotten Password

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 69,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://strapi.io/changelog release notes · advisory vendor
• https://github.com/strapi/strapi/releases release notes · advisory pihak ketiga
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-008.txt exploit · advisory pihak ketiga