Loading
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.
Use CWE-640, Strapi vendor hub and Strapi product page to widen CVE-2019-18818 into its surrounding weakness, vendor, and product context.
Compare it with CVE-2024-37818, CVE-2024-56143 and CVE-2023-39345 for nearby disclosures in the same product family.