Security Advisory
CVE-2021-46440
CVE vulnerability detail — eXtreme Datacenter Security Operations
Description
Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a victims HTTP request, get the victims cookie, perform a base64 decode on the victims cookie, and obtain a cleartext password, leading to getting API documentation for further API attacks.