UpHeron
All vulnerabilities

Servers and applications

CVE-2019-18818

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.

Severity
Critical 9.8
Published
7 Nov 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
97% in the next 30 daysHigher than 99% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
StrapiServers and applications · cpe:a:strapi:strapi
  • Version 3.0.0-beta17.4
  • Version 3.0.0-beta17.3
  • Version 3.0.0-beta17.2
  • Version 3.0.0-beta17.1
All 90 release lines
  • Every version up to 1.6.4
  • Version 3.0.0-alpha4
  • Version 3.0.0-alpha4.8
  • Version 3.0.0-alpha5.3
  • Version 3.0.0-alpha5.5
  • Version 3.0.0-alpha6.3
  • Version 3.0.0-alpha6.4
  • Version 3.0.0-alpha6.7
  • Version 3.0.0-alpha7.2
  • Version 3.0.0-alpha7.3
  • Version 3.0.0-alpha8
  • Version 3.0.0-alpha8.3
  • Version 3.0.0-alpha9
  • Version 3.0.0-alpha9.1
  • Version 3.0.0-alpha9.2
  • Version 3.0.0-alpha10.1
  • Version 3.0.0-alpha10.2
  • Version 3.0.0-alpha10.3
  • Version 3.0.0-alpha11
  • Version 3.0.0-alpha11.1
  • Version 3.0.0-alpha11.2
  • Version 3.0.0-alpha11.3
  • Version 3.0.0-alpha12
  • Version 3.0.0-alpha12.1
  • Version 3.0.0-alpha12.1.3
  • Version 3.0.0-alpha12.2
  • Version 3.0.0-alpha12.3
  • Version 3.0.0-alpha12.4
  • Version 3.0.0-alpha12.5
  • Version 3.0.0-alpha12.6
  • Version 3.0.0-alpha12.7
  • Version 3.0.0-alpha12.7.1
  • Version 3.0.0-alpha13
  • Version 3.0.0-alpha13.0.1
  • Version 3.0.0-alpha13.1
  • Version 3.0.0-alpha14
  • Version 3.0.0-alpha14.1
  • Version 3.0.0-alpha14.1.1
  • Version 3.0.0-alpha14.2
  • Version 3.0.0-alpha14.3
  • Version 3.0.0-alpha14.4.0
  • Version 3.0.0-alpha14.5
  • Version 3.0.0-alpha15
  • Version 3.0.0-alpha16
  • Version 3.0.0-alpha17
  • Version 3.0.0-alpha18
  • Version 3.0.0-alpha19
  • Version 3.0.0-alpha20
  • Version 3.0.0-alpha21
  • Version 3.0.0-alpha22
  • Version 3.0.0-alpha23
  • Version 3.0.0-alpha23.1
  • Version 3.0.0-alpha24
  • Version 3.0.0-alpha24.1
  • Version 3.0.0-alpha25
  • Version 3.0.0-alpha25.1
  • Version 3.0.0-alpha25.2
  • Version 3.0.0-alpha26
  • Version 3.0.0-alpha26.1
  • Version 3.0.0-alpha26.2
  • Version 3.0.0-beta0
  • Version 3.0.0-beta1
  • Version 3.0.0-beta2
  • Version 3.0.0-beta3
  • Version 3.0.0-beta4
  • Version 3.0.0-beta5
  • Version 3.0.0-beta6
  • Version 3.0.0-beta7
  • Version 3.0.0-beta8
  • Version 3.0.0-beta9
  • Version 3.0.0-beta10
  • Version 3.0.0-beta11
  • Version 3.0.0-beta12
  • Version 3.0.0-beta13
  • Version 3.0.0-beta14
  • Version 3.0.0-beta15
  • Version 3.0.0-beta16
  • Version 3.0.0-beta16.1
  • Version 3.0.0-beta16.2
  • Version 3.0.0-beta16.3
  • Version 3.0.0-beta16.4
  • Version 3.0.0-beta16.5
  • Version 3.0.0-beta16.6
  • Version 3.0.0-beta16.7
  • Version 3.0.0-beta16.8
  • Version 3.0.0-beta17
  • Version 3.0.0-beta17.1
  • Version 3.0.0-beta17.2
  • Version 3.0.0-beta17.3
  • Version 3.0.0-beta17.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-18818
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-18818