{"action":"Upgrade strapi to 3.6.9 or later.","affected":[{"fixed":"3.6.9","introduced":"0"}],"component":"strapi","cve_ids":["CVE-2021-46440"],"ecosystem":"npm","epss":0.02883,"exploited":false,"fixed_versions":["3.6.9"],"ghsa_id":"GHSA-85vg-grr5-pw42","id":"tcs_01M5KFBWMC7APVRR9B88W88AQB","modified_at":"2023-11-08T04:07:26.265312Z","published_at":"2022-05-04T00:00:22Z","references":["https://osv.dev/vulnerability/GHSA-85vg-grr5-pw42","https://nvd.nist.gov/vuln/detail/CVE-2021-46440","https://github.com/strapi/strapi/pull/12246","https://github.com/strapi/strapi","https://hub.docker.com/r/strapi/strapi","https://strapi.io","http://packetstormsecurity.com/files/166915/Strapi-3.6.8-Password-Disclosure-Insecure-Handling.html"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-85vg-grr5-pw42","url":"https://osv.dev/vulnerability/GHSA-85vg-grr5-pw42"}],"summary":"Insecure password handling vulnerability in Strapi"}