high8.6
CVE-2024-37818
Strapi Server-Side Request Forgery (SSRF)
Impact
Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image. This vulnerability allows attackers to scan for open ports or access sensitive information via a crafted GET request.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @strapi/strapi | = 4.24.4 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Strapi | Strapi | Version 4.24.4 |