Insecure Password Storage in Strapi Documentation Plugin
CVE-2021-46440
7.5HIGH
What is CVE-2021-46440?
The Strapi Documentation plugin prior to versions 3.6.9 and 4.1.5 contains a vulnerability that permits the storage of passwords in a recoverable format. This flaw allows an attacker to exploit HTTP requests to obtain a victim's cookie, decode it using base64, and extract the cleartext password. This not only compromises user data but also potentially enables further API attacks due to unauthorized access to sensitive API documentation.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
References
CVSS V3.1
Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved