critical9.8
CVE-2020-27664
Authorization bypass in Strapi
Impact
`admin/src/containers/InputModalStepperProvider/index.js` in Strapi before 3.2.5 has unwanted `/proxy?url=` functionality.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | strapi | < 3.2.5 | 3.2.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Strapi | Strapi | before 3.2.5 |