Password Change Vulnerability in Strapi Admin Panel

CVE-2021-28128

What is CVE-2021-28128?

A security flaw in Strapi through version 3.6.0 allows users to change their passwords without entering their current password in the admin panel. This oversight can be exploited by an attacker who has obtained a valid session, enabling them to take control of a user's account by altering the password without authorization. It is crucial for users to be aware of this risk and to implement safe practices such as session monitoring and access controls to protect sensitive accounts.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References