Vulnerability-Lookup

WID-SEC-W-2025-2332

Vulnerability from csaf_certbund - Published: 2025-10-16 22:00 - Updated: 2025-10-16 22:00

Summary

Strapi: Mehrere Schwachstellen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Strapi ist ein headless Content-Management-System (CMS), dass als Open-Source-Software entwickelt wird.

Angriff

Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Strapi ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial-of-Service-Zustand zu verursachen und vertrauliche Informationen offenzulegen.

Betroffene Betriebssysteme

- Sonstiges - UNIX - Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Strapi ist ein headless Content-Management-System (CMS), dass als Open-Source-Software entwickelt wird.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Strapi ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial-of-Service-Zustand zu verursachen und vertrauliche Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-2332 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2332.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-2332 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2332"
      },
      {
        "category": "external",
        "summary": "Strapi GitHub vom 2025-10-16",
        "url": "https://github.com/strapi/strapi/security/advisories/GHSA-9329-mxxw-qwf8"
      },
      {
        "category": "external",
        "summary": "Strapi GitHub vom 2025-10-16",
        "url": "https://github.com/strapi/strapi/security/advisories/GHSA-495j-h493-42q2"
      },
      {
        "category": "external",
        "summary": "Strapi GitHub vom 2025-10-16",
        "url": "https://github.com/strapi/strapi/security/advisories/GHSA-2cjv-6wg9-f4f3"
      },
      {
        "category": "external",
        "summary": "NIST Vulnerability Database vom 2025-10-16",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3930"
      }
    ],
    "source_lang": "en-US",
    "title": "Strapi: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2025-10-16T22:00:00.000+00:00",
      "generator": {
        "date": "2025-10-17T09:28:25.075+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.4.0"
        }
      },
      "id": "WID-SEC-W-2025-2332",
      "initial_release_date": "2025-10-16T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-10-16T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c5.20.0",
                "product": {
                  "name": "Open Source Strapi \u003c5.20.0",
                  "product_id": "T047791"
                }
              },
              {
                "category": "product_version",
                "name": "5.20.0",
                "product": {
                  "name": "Open Source Strapi 5.20.0",
                  "product_id": "T047791-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:strapi:strapi:5.20.0"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c5.5.2",
                "product": {
                  "name": "Open Source Strapi \u003c5.5.2",
                  "product_id": "T047792"
                }
              },
              {
                "category": "product_version",
                "name": "5.5.2",
                "product": {
                  "name": "Open Source Strapi 5.5.2",
                  "product_id": "T047792-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:strapi:strapi:5.5.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c5.10.3",
                "product": {
                  "name": "Open Source Strapi \u003c5.10.3",
                  "product_id": "T047793"
                }
              },
              {
                "category": "product_version",
                "name": "5.10.3",
                "product": {
                  "name": "Open Source Strapi 5.10.3",
                  "product_id": "T047793-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:strapi:strapi:5.10.3"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c5.24.1",
                "product": {
                  "name": "Open Source Strapi \u003c5.24.1",
                  "product_id": "T047794"
                }
              },
              {
                "category": "product_version",
                "name": "5.24.1",
                "product": {
                  "name": "Open Source Strapi 5.24.1",
                  "product_id": "T047794-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:strapi:strapi:5.24.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Strapi"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-56143",
      "product_status": {
        "known_affected": [
          "T047792"
        ]
      },
      "release_date": "2025-10-16T22:00:00.000+00:00",
      "title": "CVE-2024-56143"
    },
    {
      "cve": "CVE-2025-25298",
      "product_status": {
        "known_affected": [
          "T047793",
          "T047792"
        ]
      },
      "release_date": "2025-10-16T22:00:00.000+00:00",
      "title": "CVE-2025-25298"
    },
    {
      "cve": "CVE-2025-3930",
      "product_status": {
        "known_affected": [
          "T047793",
          "T047794",
          "T047791",
          "T047792"
        ]
      },
      "release_date": "2025-10-16T22:00:00.000+00:00",
      "title": "CVE-2025-3930"
    },
    {
      "cve": "CVE-2025-53092",
      "product_status": {
        "known_affected": [
          "T047793",
          "T047791",
          "T047792"
        ]
      },
      "release_date": "2025-10-16T22:00:00.000+00:00",
      "title": "CVE-2025-53092"
    }
  ]
}

CVE-2025-3930 (GCVE-0-2025-3930)

Vulnerability from cvelistv5 – Published: 2025-10-16 10:43 – Updated: 2025-10-22 06:59 X_Open Source

Title

Lack of JWT Expiration after Log Out in Strapi

Summary

Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date (which is set to 30 days by default, but can be changed). The existence of /admin/renew-token endpoint allows anyone to renew near-expiration tokens indefinitely, further increasing the impact of this attack. This issue has been fixed in version 5.24.1.

Severity ?

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CWE

CWE-613 - Insufficient Session Expiration

Assigner

CERT-PL

References

URL

Tags

	https://cert.pl/en/posts/2025/06/CVE-2025-3930	third-party-advisory
	https://github.com/strapi/strapi	product
	https://strapi.io/	product
	https://strapi.io/blog/security-disclosure-of-vul…	vendor-advisory

Impacted products

	Vendor	Product	Version
	Strapi	Strapi	Affected: 0 , < 5.24.1 (semver)

Credits

Arkadiusz Marta

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-3930",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-16T13:37:13.822536Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-16T13:37:36.428Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Strapi",
          "vendor": "Strapi",
          "versions": [
            {
              "lessThan": "5.24.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Arkadiusz Marta"
        }
      ],
      "datePublic": "2025-10-16T09:55:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eStrapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date (which is set to 30 days by default, but can be changed).\u003c/span\u003e \u003cbr\u003eThe existence of \u003ctt\u003e/admin/renew-token\u0026nbsp;\u003c/tt\u003eendpoint allows anyone to renew near-expiration tokens indefinitely, further increasing the impact of this attack. \u003cbr\u003e\u003cbr\u003eThis issue has been fixed in version 5.24.1.\u003ctt\u003e\u003ctt\u003e\u003cbr\u003e\u003ctt\u003e\u003c/tt\u003e\u003c/tt\u003e\u003c/tt\u003e"
            }
          ],
          "value": "Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date (which is set to 30 days by default, but can be changed). \nThe existence of /admin/renew-token\u00a0endpoint allows anyone to renew near-expiration tokens indefinitely, further increasing the impact of this attack. \n\nThis issue has been fixed in version 5.24.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-22T06:59:29.045Z",
        "orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
        "shortName": "CERT-PL"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://cert.pl/en/posts/2025/06/CVE-2025-3930"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/strapi/strapi"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://strapi.io/"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve-October-2025"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "Lack of JWT Expiration after Log Out in Strapi",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
    "assignerShortName": "CERT-PL",
    "cveId": "CVE-2025-3930",
    "datePublished": "2025-10-16T10:43:21.382Z",
    "dateReserved": "2025-04-25T06:46:23.142Z",
    "dateUpdated": "2025-10-22T06:59:29.045Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-56143 (GCVE-0-2024-56143)

Vulnerability from cvelistv5 – Published: 2025-10-16 16:07 – Updated: 2025-10-16 17:54

Title

Strapi Allows Unauthorized Access to Private Fields via parms.lookup

Summary

Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the document service does not properly sanitize query parameters for private fields. An attacker can access private fields, including admin passwords and reset tokens, by crafting queries with the lookup parameter. This vulnerability is fixed in 5.5.2.

Severity ?

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M

References

URL

Tags

	https://github.com/strapi/strapi/security/advisor…	x_refsource_CONFIRM
	https://github.com/strapi/strapi/commit/0c6e0953a…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	strapi	strapi	Affected: >= 5.0.0, < 5.5.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-56143",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-16T16:26:01.056016Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-16T16:26:32.391Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "strapi",
          "vendor": "strapi",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 5.5.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the document service does not properly sanitize query parameters for private fields. An attacker can access private fields, including admin passwords and reset tokens, by crafting queries with the lookup parameter. This vulnerability is fixed in 5.5.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-16T17:54:24.103Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/strapi/strapi/security/advisories/GHSA-495j-h493-42q2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/strapi/strapi/security/advisories/GHSA-495j-h493-42q2"
        },
        {
          "name": "https://github.com/strapi/strapi/commit/0c6e0953ae1e62afae9329de7ae6d6a5e21b95b8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/strapi/strapi/commit/0c6e0953ae1e62afae9329de7ae6d6a5e21b95b8"
        }
      ],
      "source": {
        "advisory": "GHSA-495j-h493-42q2",
        "discovery": "UNKNOWN"
      },
      "title": "Strapi Allows Unauthorized Access to Private Fields via parms.lookup"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-56143",
    "datePublished": "2025-10-16T16:07:30.996Z",
    "dateReserved": "2024-12-16T18:04:39.983Z",
    "dateUpdated": "2025-10-16T17:54:24.103Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-53092 (GCVE-0-2025-53092)

Vulnerability from cvelistv5 – Published: 2025-10-16 16:29 – Updated: 2025-10-16 18:13

Title

Strapi core vulnerable to sensitive data exposure via CORS misconfiguration

Summary

Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper validation or whitelisting. This allows an attacker-controlled site to send credentialed requests to the Strapi backend. An attacker can exploit this by hosting a malicious site on a different origin (e.g., different port) and sending requests with credentials to the Strapi API. The vulnerability is fixed in version 5.20.0. No known workarounds exist.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-284 - Improper Access Control
CWE-364 - Signal Handler Race Condition
CWE-942 - Permissive Cross-domain Policy with Untrusted Domains

Assigner

GitHub_M

References

URL

Tags

https://github.com/strapi/strapi/security/advisor…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	strapi	strapi	Affected: < 5.20.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-53092",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-16T18:03:56.017150Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-16T18:13:08.618Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "strapi",
          "vendor": "strapi",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.20.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper validation or whitelisting. This allows an attacker-controlled site to send credentialed requests to the Strapi backend. An attacker can exploit this by hosting a malicious site on a different origin (e.g., different port) and sending requests with credentials to the Strapi API. The vulnerability is fixed in version 5.20.0. No known workarounds exist."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-364",
              "description": "CWE-364: Signal Handler Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-942",
              "description": "CWE-942: Permissive Cross-domain Policy with Untrusted Domains",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-16T16:29:35.246Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/strapi/strapi/security/advisories/GHSA-9329-mxxw-qwf8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/strapi/strapi/security/advisories/GHSA-9329-mxxw-qwf8"
        }
      ],
      "source": {
        "advisory": "GHSA-9329-mxxw-qwf8",
        "discovery": "UNKNOWN"
      },
      "title": "Strapi core vulnerable to sensitive data exposure via CORS misconfiguration"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-53092",
    "datePublished": "2025-10-16T16:29:35.246Z",
    "dateReserved": "2025-06-25T13:41:23.085Z",
    "dateUpdated": "2025-10-16T18:13:08.618Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-25298 (GCVE-0-2025-25298)

Vulnerability from cvelistv5 – Published: 2025-10-16 16:21 – Updated: 2025-10-16 18:12

Title

Missing Maximum Password Length Validation in Strapi Password Hashing

Summary

Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently truncated. A user can create an account with a password exceeding 72 bytes and later authenticate with only the first 72 bytes. This reduces the effective entropy of overlong passwords and may mislead users who believe characters beyond 72 bytes are required, creating a low likelihood of unintended authentication if an attacker can obtain or guess the truncated portion. Long over‑length inputs can also impose unnecessary processing overhead. The issue is fixed in version 5.10.3. No known workarounds exist.

Severity ?

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-261 - Weak Encoding for Password

Assigner

GitHub_M

References

URL

Tags

	https://github.com/strapi/strapi/security/advisor…	x_refsource_CONFIRM
	https://github.com/strapi/strapi/commit/41f8cdf11…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	strapi	strapi	Affected: < 5.10.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-25298",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-16T18:08:48.659254Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-16T18:12:49.837Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "strapi",
          "vendor": "strapi",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.10.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently truncated. A user can create an account with a password exceeding 72 bytes and later authenticate with only the first 72 bytes. This reduces the effective entropy of overlong passwords and may mislead users who believe characters beyond 72 bytes are required, creating a low likelihood of unintended authentication if an attacker can obtain or guess the truncated portion. Long over\u2011length inputs can also impose unnecessary processing overhead. The issue is fixed in version 5.10.3. No known workarounds exist."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-261",
              "description": "CWE-261: Weak Encoding for Password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-16T16:21:45.585Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/strapi/strapi/security/advisories/GHSA-2cjv-6wg9-f4f3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/strapi/strapi/security/advisories/GHSA-2cjv-6wg9-f4f3"
        },
        {
          "name": "https://github.com/strapi/strapi/commit/41f8cdf116f7f464dae7d591e52d88f7bfa4b7cb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/strapi/strapi/commit/41f8cdf116f7f464dae7d591e52d88f7bfa4b7cb"
        }
      ],
      "source": {
        "advisory": "GHSA-2cjv-6wg9-f4f3",
        "discovery": "UNKNOWN"
      },
      "title": "Missing Maximum Password Length Validation in Strapi Password Hashing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-25298",
    "datePublished": "2025-10-16T16:21:45.585Z",
    "dateReserved": "2025-02-06T17:13:33.123Z",
    "dateUpdated": "2025-10-16T18:12:49.837Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2025-2332

CVE-2025-3930 (GCVE-0-2025-3930)

CVE-2024-56143 (GCVE-0-2024-56143)

CVE-2025-53092 (GCVE-0-2025-53092)

CVE-2025-25298 (GCVE-0-2025-25298)

Tags

Sightings

Nomenclature