CVE-2022-29894 Cross-site Scripting in Strapi

What is CVE-2022-29894?

CVE-2022-29894 is a medium-severity cross-site scripting vulnerability in Strapi, published on 13 Jun 2022. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege.

Weakness: CWE-79

Which versions are affected by CVE-2022-29894?

2 open source packages ship an affected version, including strapi. It affects 1 product.

Products include Strapi Strapi.

How do I fix CVE-2022-29894?

No fix has been published for CVE-2022-29894 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-29894 being exploited?

There is no known exploitation of CVE-2022-29894 in the wild and no public exploit code.

Other vulnerabilities in Strapi

• CVE-2023-22894 Strapi Cleartext Storage of Sensitive Information Exploited High 7.2
• CVE-2023-22621 Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin Critical 10.0
• CVE-2022-27263 Unrestricted Upload of File with Dangerous Type in Strapi Critical 9.8
• CVE-2020-27664 Authorization bypass in Strapi Critical 9.8
• CVE-2019-18818 Strapi allows unauthenticated attacker to reset admin password without valid reset token Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mcqm-6ff4-53qx.