{ "affected": [ { "ranges": [ { "database_specific": { "cpe": "cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "0" }, { "last_affected": "1.6.4" } ], "source": "CPE_RANGE" }, "events": [ { "introduced": "0" }, { "last_affected": "3493c76c1fbb33d4e435d592c6df967bf5dcb90b" } ], "repo": "https://github.com/strapi/strapi", "type": "GIT" } ] } ], "database_specific": { "unresolved_ranges": [ { "cpes": [ "cpe:2.3:a:strapi:strapi:3.0.0:alpha10.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha10.2:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha10.3:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha11.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha11.2:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha11.3:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha11:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1.3:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha12.2:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha12.3:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha12.4:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha12.5:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha12.6:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha12:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha13.0.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha13.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha13:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha14.2:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha14.3:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha14.4.0:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha14.5:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha14:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha15:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha16:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha17:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha18:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha19:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha20:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha21:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha22:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha23.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha23:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha24.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha24:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha25.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha25.2:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha25:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha26.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha26.2:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha26:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha4.8:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha4:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha5.3:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha5.5:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha6.3:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha6.4:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha6.7:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha7.2:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha7.3:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha8.3:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha8:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha9.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha9.2:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:alpha9:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta0:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta10:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta11:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta12:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta13:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta14:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta15:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta16.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta16.2:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta16.3:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta16.4:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta16.5:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta16.6:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta16.7:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta16.8:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta16:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta17.1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta17.2:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta17.3:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta17.4:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta17.5:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta17.6:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta17.7:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta17:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta1:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta2:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta3:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta4:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta5:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta6:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta7:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta8:*:*:*:*:*:*", "cpe:2.3:a:strapi:strapi:3.0.0:beta9:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "3.0.0-alpha10\\.1" }, { "last_affected": "3.0.0-alpha10\\.1" }, { "introduced": "3.0.0-alpha10\\.2" }, { "last_affected": "3.0.0-alpha10\\.2" }, { "introduced": "3.0.0-alpha10\\.3" }, { "last_affected": "3.0.0-alpha10\\.3" }, { "introduced": "3.0.0-alpha11" }, { "last_affected": "3.0.0-alpha11" }, { "introduced": "3.0.0-alpha11\\.1" }, { "last_affected": "3.0.0-alpha11\\.1" }, { "introduced": "3.0.0-alpha11\\.2" }, { "last_affected": "3.0.0-alpha11\\.2" }, { "introduced": "3.0.0-alpha11\\.3" }, { "last_affected": "3.0.0-alpha11\\.3" }, { "introduced": "3.0.0-alpha12" }, { "last_affected": "3.0.0-alpha12" }, { "introduced": "3.0.0-alpha12\\.1" }, { "last_affected": "3.0.0-alpha12\\.1" }, { "introduced": "3.0.0-alpha12\\.1\\.3" }, { "last_affected": "3.0.0-alpha12\\.1\\.3" }, { "introduced": "3.0.0-alpha12\\.2" }, { "last_affected": "3.0.0-alpha12\\.2" }, { "introduced": "3.0.0-alpha12\\.3" }, { "last_affected": "3.0.0-alpha12\\.3" }, { "introduced": "3.0.0-alpha12\\.4" }, { "last_affected": "3.0.0-alpha12\\.4" }, { "introduced": "3.0.0-alpha12\\.5" }, { "last_affected": "3.0.0-alpha12\\.5" }, { "introduced": "3.0.0-alpha12\\.6" }, { "last_affected": "3.0.0-alpha12\\.6" }, { "introduced": "3.0.0-alpha12\\.7" }, { "last_affected": "3.0.0-alpha12\\.7" }, { "introduced": "3.0.0-alpha12\\.7\\.1" }, { "last_affected": "3.0.0-alpha12\\.7\\.1" }, { "introduced": "3.0.0-alpha13" }, { "last_affected": "3.0.0-alpha13" }, { "introduced": "3.0.0-alpha13\\.0\\.1" }, { "last_affected": "3.0.0-alpha13\\.0\\.1" }, { "introduced": "3.0.0-alpha13\\.1" }, { "last_affected": "3.0.0-alpha13\\.1" }, { "introduced": "3.0.0-alpha14" }, { "last_affected": "3.0.0-alpha14" }, { "introduced": "3.0.0-alpha14\\.1" }, { "last_affected": "3.0.0-alpha14\\.1" }, { "introduced": "3.0.0-alpha14\\.1\\.1" }, { "last_affected": "3.0.0-alpha14\\.1\\.1" }, { "introduced": "3.0.0-alpha14\\.2" }, { "last_affected": "3.0.0-alpha14\\.2" }, { "introduced": "3.0.0-alpha14\\.3" }, { "last_affected": "3.0.0-alpha14\\.3" }, { "introduced": "3.0.0-alpha14\\.4\\.0" }, { "last_affected": "3.0.0-alpha14\\.4\\.0" }, { "introduced": "3.0.0-alpha14\\.5" }, { "last_affected": "3.0.0-alpha14\\.5" }, { "introduced": "3.0.0-alpha15" }, { "last_affected": "3.0.0-alpha15" }, { "introduced": "3.0.0-alpha16" }, { "last_affected": "3.0.0-alpha16" }, { "introduced": "3.0.0-alpha17" }, { "last_affected": "3.0.0-alpha17" }, { "introduced": "3.0.0-alpha18" }, { "last_affected": "3.0.0-alpha18" }, { "introduced": "3.0.0-alpha19" }, { "last_affected": "3.0.0-alpha19" }, { "introduced": "3.0.0-alpha20" }, { "last_affected": "3.0.0-alpha20" }, { "introduced": "3.0.0-alpha21" }, { "last_affected": "3.0.0-alpha21" }, { "introduced": "3.0.0-alpha22" }, { "last_affected": "3.0.0-alpha22" }, { "introduced": "3.0.0-alpha23" }, { "last_affected": "3.0.0-alpha23" }, { "introduced": "3.0.0-alpha23\\.1" }, { "last_affected": "3.0.0-alpha23\\.1" }, { "introduced": "3.0.0-alpha24" }, { "last_affected": "3.0.0-alpha24" }, { "introduced": "3.0.0-alpha24\\.1" }, { "last_affected": "3.0.0-alpha24\\.1" }, { "introduced": "3.0.0-alpha25" }, { "last_affected": "3.0.0-alpha25" }, { "introduced": "3.0.0-alpha25\\.1" }, { "last_affected": "3.0.0-alpha25\\.1" }, { "introduced": "3.0.0-alpha25\\.2" }, { "last_affected": "3.0.0-alpha25\\.2" }, { "introduced": "3.0.0-alpha26" }, { "last_affected": "3.0.0-alpha26" }, { "introduced": "3.0.0-alpha26\\.1" }, { "last_affected": "3.0.0-alpha26\\.1" }, { "introduced": "3.0.0-alpha26\\.2" }, { "last_affected": "3.0.0-alpha26\\.2" }, { "introduced": "3.0.0-alpha4" }, { "last_affected": "3.0.0-alpha4" }, { "introduced": "3.0.0-alpha4\\.8" }, { "last_affected": "3.0.0-alpha4\\.8" }, { "introduced": "3.0.0-alpha5\\.3" }, { "last_affected": "3.0.0-alpha5\\.3" }, { "introduced": "3.0.0-alpha5\\.5" }, { "last_affected": "3.0.0-alpha5\\.5" }, { "introduced": "3.0.0-alpha6\\.3" }, { "last_affected": "3.0.0-alpha6\\.3" }, { "introduced": "3.0.0-alpha6\\.4" }, { "last_affected": "3.0.0-alpha6\\.4" }, { "introduced": "3.0.0-alpha6\\.7" }, { "last_affected": "3.0.0-alpha6\\.7" }, { "introduced": "3.0.0-alpha7\\.2" }, { "last_affected": "3.0.0-alpha7\\.2" }, { "introduced": "3.0.0-alpha7\\.3" }, { "last_affected": "3.0.0-alpha7\\.3" }, { "introduced": "3.0.0-alpha8" }, { "last_affected": "3.0.0-alpha8" }, { "introduced": "3.0.0-alpha8\\.3" }, { "last_affected": "3.0.0-alpha8\\.3" }, { "introduced": "3.0.0-alpha9" }, { "last_affected": "3.0.0-alpha9" }, { "introduced": "3.0.0-alpha9\\.1" }, { "last_affected": "3.0.0-alpha9\\.1" }, { "introduced": "3.0.0-alpha9\\.2" }, { "last_affected": "3.0.0-alpha9\\.2" }, { "introduced": "3.0.0-beta0" }, { "last_affected": "3.0.0-beta0" }, { "introduced": "3.0.0-beta1" }, { "last_affected": "3.0.0-beta1" }, { "introduced": "3.0.0-beta10" }, { "last_affected": "3.0.0-beta10" }, { "introduced": "3.0.0-beta11" }, { "last_affected": "3.0.0-beta11" }, { "introduced": "3.0.0-beta12" }, { "last_affected": "3.0.0-beta12" }, { "introduced": "3.0.0-beta13" }, { "last_affected": "3.0.0-beta13" }, { "introduced": "3.0.0-beta14" }, { "last_affected": "3.0.0-beta14" }, { "introduced": "3.0.0-beta15" }, { "last_affected": "3.0.0-beta15" }, { "introduced": "3.0.0-beta16" }, { "last_affected": "3.0.0-beta16" }, { "introduced": "3.0.0-beta16\\.1" }, { "last_affected": "3.0.0-beta16\\.1" }, { "introduced": "3.0.0-beta16\\.2" }, { "last_affected": "3.0.0-beta16\\.2" }, { "introduced": "3.0.0-beta16\\.3" }, { "last_affected": "3.0.0-beta16\\.3" }, { "introduced": "3.0.0-beta16\\.4" }, { "last_affected": "3.0.0-beta16\\.4" }, { "introduced": "3.0.0-beta16\\.5" }, { "last_affected": "3.0.0-beta16\\.5" }, { "introduced": "3.0.0-beta16\\.6" }, { "last_affected": "3.0.0-beta16\\.6" }, { "introduced": "3.0.0-beta16\\.7" }, { "last_affected": "3.0.0-beta16\\.7" }, { "introduced": "3.0.0-beta16\\.8" }, { "last_affected": "3.0.0-beta16\\.8" }, { "introduced": "3.0.0-beta17" }, { "last_affected": "3.0.0-beta17" }, { "introduced": "3.0.0-beta17\\.1" }, { "last_affected": "3.0.0-beta17\\.1" }, { "introduced": "3.0.0-beta17\\.2" }, { "last_affected": "3.0.0-beta17\\.2" }, { "introduced": "3.0.0-beta17\\.3" }, { "last_affected": "3.0.0-beta17\\.3" }, { "introduced": "3.0.0-beta17\\.4" }, { "last_affected": "3.0.0-beta17\\.4" }, { "introduced": "3.0.0-beta17\\.5" }, { "last_affected": "3.0.0-beta17\\.5" }, { "introduced": "3.0.0-beta17\\.6" }, { "last_affected": "3.0.0-beta17\\.6" }, { "introduced": "3.0.0-beta17\\.7" }, { "last_affected": "3.0.0-beta17\\.7" }, { "introduced": "3.0.0-beta2" }, { "last_affected": "3.0.0-beta2" }, { "introduced": "3.0.0-beta3" }, { "last_affected": "3.0.0-beta3" }, { "introduced": "3.0.0-beta4" }, { "last_affected": "3.0.0-beta4" }, { "introduced": "3.0.0-beta5" }, { "last_affected": "3.0.0-beta5" }, { "introduced": "3.0.0-beta6" }, { "last_affected": "3.0.0-beta6" }, { "introduced": "3.0.0-beta7" }, { "last_affected": "3.0.0-beta7" }, { "introduced": "3.0.0-beta8" }, { "last_affected": "3.0.0-beta8" }, { "introduced": "3.0.0-beta9" }, { "last_affected": "3.0.0-beta9" } ], "source": "CPE_STRING", "vendor_product": "strapi:strapi" } ] }, "details": "The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.", "id": "CVE-2019-19609", "modified": "2026-07-08T05:38:46.293183349Z", "published": "2019-12-05T20:15:10.200Z", "references": [ { "type": "FIX", "url": "https://github.com/strapi/strapi/pull/4636" }, { "type": "EVIDENCE", "url": "http://packetstormsecurity.com/files/163940/Strapi-3.0.0-beta.17.7-Remote-Code-Execution.html" }, { "type": "EVIDENCE", "url": "http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html" }, { "type": "EVIDENCE", "url": "https://bittherapy.net/post/strapi-framework-remote-code-execution/" } ], "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ] }