{"action":"Upgrade strapi to 3.0.0-beta.17.5 or later.","affected":[{"fixed":"3.0.0-beta.17.5","introduced":"0"}],"component":"strapi","cve_ids":["CVE-2019-18818"],"ecosystem":"npm","epss":0.97639,"exploited":false,"fixed_versions":["3.0.0-beta.17.5"],"ghsa_id":"GHSA-6xc2-mj39-q599","id":"tcs_01M5KF889A35PVRZ2QA43V1TM9","modified_at":"2023-11-08T04:01:26.332116Z","published_at":"2019-12-02T18:20:41Z","references":["https://osv.dev/vulnerability/GHSA-6xc2-mj39-q599","https://nvd.nist.gov/vuln/detail/CVE-2019-18818","https://github.com/strapi/strapi/pull/4443","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18818","https://github.com/strapi/strapi","https://github.com/strapi/strapi/releases/tag/v3.0.0-beta.17.5","https://www.npmjs.com/advisories/1311","http://packetstormsecurity.com/files/163939/Strapi-3.0.0-beta-Authentication-Bypass.html","http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html","http://packetstormsecurity.com/files/165896/Strapi-CMS-3.0.0-beta.17.4-Privilege-Escalation.html"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-6xc2-mj39-q599","url":"https://osv.dev/vulnerability/GHSA-6xc2-mj39-q599"}],"summary":"Strapi allows unauthenticated attacker to reset admin password without valid reset token"}