Is CVE-2021-28128 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-28128 being exploited in the wild.

How severe is CVE-2021-28128?

Low severity, with a CVSS score of 3.1, published 6 October 2021.

Which products and versions are affected?

strapi (npm) SEMVER:introduced=0,last_affected=3.6.0.

Is there a fix for CVE-2021-28128?

A patch was published on 2021-04-22: Fixed in version 3.6.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-28128 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2021-28128?

Check whether you run strapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-28128: Strapi account takeover via unverified password change in admin panel

CVE-2021-28128 · Severity: low · CVSS 3.1 · Published 2021-10-06

Strapi, a popular open-source content management system, contains a flaw in its administrative interface that allows users to change their account password without providing their current one. If an attacker gains temporary access to a user's active web session—for example, through an unattended computer or a separate session-theft vulnerability—they can permanently take over the account by setting a new password. This could lead to a total loss of access for the legitimate user and unauthorized control over the website's content.

Technologies: strapi (npm). Vendors: npm.

Quick answers

Is CVE-2021-28128 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-28128 being exploited in the wild.
How severe is CVE-2021-28128?: Low severity, with a CVSS score of 3.1, published 6 October 2021.
Which products and versions are affected?: strapi (npm) SEMVER:introduced=0,last_affected=3.6.0.
Is there a fix for CVE-2021-28128?: A patch was published on 2021-04-22: Fixed in version 3.6.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-28128 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2021-28128?: Check whether you run strapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A weak password recovery/change mechanism exists in the Strapi admin panel through version 3.6.0. The application fails to require the 'current password' as a validation step during the password update process (CWE-640/CWE-620). An attacker who obtains a valid session token or physical access to an authenticated browser session can change the account password to a value of their choosing. This results in a full account takeover and persistent access, as the original user is locked out. The vulnerability is reachable via the network by any user with access to the admin panel.

Affected products

Strapi Strapi <= 3.6.0

Identifiers

CVE-2021-28128
GHSA-37hx-4mcq-wc3h

Timeline

2021-02-26: other: Vulnerability discovered
2021-03-08: disclosed: Reported to manufacturer
2021-04-22: patched: Fixed in version 3.6.0
2021-04-26: advisory: Public disclosure by SySS GmbH

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.