Back to KEVs

CVE-2019-18818

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and...

Basic Information

CVE State
PUBLISHED
Reserved Date
November 07, 2019
Published Date
November 07, 2019
Last Updated
August 05, 2024
Vendor
Strapi
Product
Strapi
Description
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.
Tags
nuclei_scanner

CVSS Scores

CVSS v3.1

9.8 - CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Score

Score
94.01% (Percentile: 99.88%) as of 2025-06-03

Exploit Status

Exploited in the Wild
Yes (added 2025-05-26 00:00:00 UTC) Source

References

https://github.com/strapi/strapi/pull/4443 https://github.com/strapi/strapi/releases/tag/v3.0.0-beta.17.5 https://www.npmjs.com/advisories/1311 http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html http://packetstormsecurity.com/files/163939/Strapi-3.0.0-beta-Authentication-Bypass.html http://packetstormsecurity.com/files/165896/Strapi-CMS-3.0.0-beta.17.4-Privilege-Escalation.html

Known Exploited Vulnerability Information

Source Added Date
The Shadowserver (via CIRCL) 2025-05-27 12:00:42 UTC

Scanner Integrations

Scanner URL Date Detected
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-18818.yaml 2025-04-26 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

abelsrzz/CVE-2019-18818_CVE-2019-19609

Type: github • Created: 2025-02-16 19:43:11 UTC • Stars: 0

This repository contains a Python script to exploit two vulnerabilities: CVE-2019-18818 and CVE-2019-19609.

rasyidfox/CVE-2019-18818

Type: github • Created: 2021-10-11 05:24:04 UTC • Stars: 0

guglia001/CVE-2019-18818

Type: github • Created: 2021-08-29 23:30:15 UTC • Stars: 3

ossf-cve-benchmark/CVE-2019-18818

Type: github • Created: 2020-12-01 09:18:58 UTC • Stars: 0

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Detected by Nuclei

  • Added to KEVIntel