CVE-2021-28128: High severity strapi vulnerability
Published May 6, 2021
·Updated
In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password.
Affected Software
2 affected components
npm/strapi<=3.6.0
Strapi Strapi<=3.6.0
Event History
May 6, 2021
CVE Published
via MITRE·01:49 PM
Data Sourced
via MITRE·01:49 PM
Description
Oct 6, 2021
Advisory Published
05:48 PM
Frequently Asked Questions
1
What is the severity of CVE-2021-28128?
The severity of CVE-2021-28128 is high with a CVSS score of 8.1.
2
How does CVE-2021-28128 impact Strapi?
CVE-2021-28128 allows an attacker with a valid session to change an account's password without entering the current password, potentially leading to account takeover.
3
Which versions of Strapi are affected by CVE-2021-28128?
Versions up to and including 3.6.0 of Strapi are affected by CVE-2021-28128.
4
How can I fix CVE-2021-28128?
Upgrade to a version of Strapi newer than 3.6.0 to fix CVE-2021-28128.
5
Where can I find more information about CVE-2021-28128?
More information about CVE-2021-28128 can be found at the following references: [1] [2] [3]