CVE-2021-46440

Name of the Vulnerable Software and Affected Versions Strapi versions prior to 3.6.9 Strapi versions 4.x prior to 4.1.5

Description The issue arises from storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi. This allows an attacker to access a victim's HTTP request, obtain the victim's cookie, perform a base64 decode on the cookie, and obtain a cleartext password. This can lead to the attacker getting API documentation for further API attacks.

Recommendations For Strapi versions prior to 3.6.9, update to version 3.6.9 or later. For Strapi versions 4.x prior to 4.1.5, update to version 4.1.5 or later. As a temporary workaround, consider restricting access to the DOCUMENTATION plugin component until a patch is available.