Skip to content
OpenAdvisories
High WID-SEC-2025-2332 4 CVEs

Strapi: Mehrere Schwachstellen

Published Oct 16, 2025 · Updated Oct 16, 2025 · de-DE

Platform: Windows

Summary

Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Strapi ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial-of-Service-Zustand zu verursachen und vertrauliche Informationen offenzulegen.

Product

Strapi ist ein headless Content-Management-System (CMS), dass als Open-Source-Software entwickelt wird.

Vulnerabilities 4

  • High 8.2
    CVE-2024-56143

    Strapi Allows Unauthorized Access to Private Fields via parms.lookup

    Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the document service does not properly sanitize query parameters for private fields. An attacker can access private fields, in…

    strapi strapi @strapi/core npm
  • Medium 6.5
    CVE-2025-53092

    Strapi core vulnerable to sensitive data exposure via CORS misconfiguration

    Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Or…

    strapi strapi @strapi/core npm
  • Medium 6.3
    CVE-2025-25298

    Missing Maximum Password Length Validation in Strapi Password Hashing

    Strapi is an open source headless CMS. The @strapi/core package before version 5.10.3 does not enforce a maximum password length when using bcryptjs for password hashing. Bcryptjs ignores any bytes beyond 72, so passwords longer than 72 bytes are silently tru…

    strapi strapi @strapi/core npm
  • Medium 6.3
    CVE-2025-3930

    Lack of JWT Expiration after Log Out in Strapi

    Strapi uses JSON Web Tokens (JWT) for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date (which is set to 30 days by d…

    strapi strapi @strapi/strapi npm

Revision history

  1. #1

    Initiale Fassung

References