{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"4.1.12"}],"component":"@strapi/strapi","cve_ids":["CVE-2022-32114"],"ecosystem":"npm","epss":0.01974,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-4vm8-j95f-j6v5","id":"tcs_01M5KF1J0DSG5SPVHCP5GEZD1B","modified_at":"2024-03-21T17:36:58Z","published_at":"2022-07-14T00:00:16Z","references":["https://osv.dev/vulnerability/GHSA-4vm8-j95f-j6v5","https://nvd.nist.gov/vuln/detail/CVE-2022-32114","https://docs.strapi.io/dev-docs/configurations/public-assets","https://docs.strapi.io/user-docs/users-roles-permissions/configuring-administrator-roles","https://github.com/bypazs/strapi","https://github.com/strapi/strapi","https://github.com/strapi/strapi/blob/d9277d616b4478a3839e79e47330a4aaf167a2f1/packages/core/content-type-builder/admin/src/components/AllowedTypesSelect/index.js#L14","https://github.com/strapi/strapi/blob/d9277d616b4478a3839e79e47330a4aaf167a2f1/packages/core/upload/admin/src/components/MediaLibraryInput/index.js#L33","https://grimthereaperteam.medium.com/strapi-v4-1-12-unrestricted-file-upload-b993bfd07e4e"],"severity":{"label":"medium","score":4.6},"sources":[{"source":"osv","source_id":"GHSA-4vm8-j95f-j6v5","url":"https://osv.dev/vulnerability/GHSA-4vm8-j95f-j6v5"}],"summary":"Strapi 4.1.12 Cross-site Scripting via crafted file"}