CVE-2022-29894

low-risk

Published 2022-06-13

Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege.

Do I need to act?

0.48% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.8/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Strapi

Affected Vendors

Strapi

References (6)

Product https://github.com/strapi/strapi

Third Party Advisory https://jvn.jp/en/jp/JVN44550983/index.html

Vendor Advisory https://strapi.io/

Product https://github.com/strapi/strapi

Third Party Advisory https://jvn.jp/en/jp/JVN44550983/index.html

Vendor Advisory https://strapi.io/

/ 100

low-risk

Severity 19/34 · Moderate

Exploitability 2/34 · Minimal

Exposure 5/34 · Minimal