Is CVE-2020-8123 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-8123 being exploited in the wild.

How severe is CVE-2020-8123?

Low severity, with a CVSS score of 3.1, published 10 December 2021.

Which products and versions are affected?

@strapi/admin (npm) SEMVER:introduced=0,fixed=3.0.0-beta.18.4.

Is there a fix for CVE-2020-8123?

Yes. @strapi/admin (npm): upgrade to 3.0.0-beta.18.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-8123 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-8123?

Check whether you run @strapi/admin (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-8123: Strapi denial of service in admin plugin management

CVE-2020-8123 · Severity: low · CVSS 3.1 · Published 2021-12-10

A vulnerability in the Strapi headless content management system allows an administrative user to crash the application. By sending a specially crafted request through the admin console, an attacker can force the service to restart, leading to a denial of service. This disrupts the availability of the CMS for content editors and any connected applications.

Technologies: @strapi/admin (npm). Vendors: npm.

Quick answers

Is CVE-2020-8123 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-8123 being exploited in the wild.
How severe is CVE-2020-8123?: Low severity, with a CVSS score of 3.1, published 10 December 2021.
Which products and versions are affected?: @strapi/admin (npm) SEMVER:introduced=0,fixed=3.0.0-beta.18.4.
Is there a fix for CVE-2020-8123?: Yes. @strapi/admin (npm): upgrade to 3.0.0-beta.18.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-8123 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-8123?: Check whether you run @strapi/admin (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@strapi/admin (npm): upgrade to 3.0.0-beta.18.4 or later
```
npm install @strapi/admin@3.0.0-beta.18.4
```

Technical details

An uncontrolled resource consumption vulnerability (CWE-400) exists in the strapi-admin package of Strapi. The flaw is located in the plugin installation/uninstallation controllers where insufficient validation of plugin names allows an authenticated user with administrative privileges to trigger an unhandled exception or resource exhaustion that results in the application restarting. The fix introduced a regular expression validator (PLUGIN_NAME_REGEX) to ensure plugin names conform to expected alphanumeric formats. This issue is resolved in version 3.0.0-beta.18.4.

Affected products

Strapi strapi-admin <= 3.0.0-beta.18.3

Identifiers

CVE-2020-8123
GHSA-23fp-fmrv-f5px

Timeline

2020-02-04: advisory: NVD published CVE-2020-8123
2021-12-10: disclosed: GHSA-23fp-fmrv-f5px published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.