CVE-2024-37818

HIGH EPSS 42.1%
Published Jun 20, 20242y ago · Modified Jun 17, 20261w ago
8.6 CVSS 3.1
High
Find Similar
Published Jun 20, 2024 2y ago
Last Modified Jun 17, 2026 1w ago

Description

Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image. This vulnerability allows attackers to scan for open ports or access sensitive information via a crafted GET request. NOTE: The Strapi Development Community argues that this issue is not valid. They contend that "the strapi/admin was wrongly attributed a flaw that only pertains to the strapi.io website, and which, at the end of the day, does not pose any real SSRF risk to applications that make use of the Strapi library."

CVSS Details

Base Score
8.6
Exploitability
3.9
Impact
4.0
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Changed
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
42.1% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-918 Server-Side Request Forgery (SSRF) Validation

Affected Products 1

VendorProductVersionRange
strapistrapi4.24.4any

References 2

  • medium.com https://medium.com/%40barkadevaibhav491/server-side-request-forgery-in-strapi-e02d5fe218ab
    ExploitThird Party Advisory
  • strapi.io https://strapi.io/
    Product

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.