{"id":"CVE-2021-46440","published":"2022-05-03T17:03:51Z","modified":"2024-08-04T05:02:11Z","title":"Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before…","vendor":null,"product":null,"tier":"tail","description":{"text":"Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a victim's HTTP request, get the victim's cookie, perform a base64 decode on the victim's cookie, and obtain a cleartext password, leading to getting API documentation for further API attacks.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02883,"percentile":0.86812,"provenance":"source"},"cwes":[],"references":[{"url":"https://strapi.io/","tags":["x_refsource_MISC"]},{"url":"https://hub.docker.com/r/strapi/strapi","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/166915/Strapi-3.6.8-Password-Disclosure-Insecure-Handling.html","tags":["x_refsource_MISC"]},{"url":"https://github.com/strapi/strapi/pull/12246","tags":["x_refsource_MISC"]}],"priority":{"score":22.4,"factors":[{"name":"EPSS percentile","points":17.36},{"name":"Public exploit code","points":5.0}]},"affected":[{"ecosystem":"npm","package":"strapi","vulnerableRanges":["<3.6.9"],"patched":["3.6.9"],"from":["GHSA-85vg-grr5-pw42"],"provenance":"source"},{"ecosystem":"npm","package":"@strapi/strapi","vulnerableRanges":[">=4.0.0, <4.1.5"],"patched":["4.1.5"],"from":["GHSA-85vg-grr5-pw42"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-3114","exploited":false,"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/166915/Strapi-3.6.8-Password-Disclosure-Insecure-Handling.html"],"lineage":{"packageHistory":[{"cve":"CVE-2019-19609","published":"2019-12-05","fixed":"3.0.0-beta.17.8","kev":false},{"cve":"CVE-2020-13961","published":"2020-06-19","fixed":"3.0.2","kev":false},{"cve":"CVE-2020-27664","published":"2020-10-22","fixed":"3.2.5","kev":false,"link":{"from":"CVE-2020-27664","to":"CVE-2021-46440","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:strapi","fromFixed":"3.2.5","toFixed":"3.6.9","daysApart":558}]}},{"cve":"CVE-2021-46440","published":"2022-05-03","fixed":"3.6.9","kev":false},{"cve":"CVE-2022-30617","published":"2022-05-19","fixed":"3.6.9","kev":false},{"cve":"CVE-2022-30618","published":"2022-05-19","fixed":"3.6.9","kev":false,"link":{"from":"CVE-2021-46440","to":"CVE-2022-30618","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:@strapi/strapi","fromFixed":"4.1.5","toFixed":"4.1.9","daysApart":16}]}},{"cve":"CVE-2022-31367","published":"2022-09-27","fixed":"3.6.10","kev":false}],"package":"npm:strapi"}}