Description
Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege.
Remediation
References
https://github.com/strapi/strapi
https://jvn.jp/en/jp/JVN44550983/index.html
https://strapi.io/
Related Vulnerabilities
CVE-2017-9804 Vulnerability in maven package org.apache.struts:struts2-core
CVE-2019-19771 Vulnerability in npm package crpyto-js
CVE-2017-16183 Vulnerability in npm package iter-server
CVE-2016-10682 Vulnerability in npm package massif
CVE-2020-2218 Vulnerability in maven package org.jenkins-ci.plugins:hp-quality-center