2022-05-03 17:03:51
mitre
PUBLISHED
Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacker to access a victims HTTP request, get the victims cookie, perform a base64 decode on the victims cookie, and obtain a cleartext password, leading to getting API documentation for further API attacks.