{"id":"CVE-2020-8123","details":"A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application.","aliases":["GHSA-23fp-fmrv-f5px"],"modified":"2026-07-07T08:50:47.841767854Z","published":"2020-02-04T20:15:14.447Z","database_specific":{"unresolved_ranges":[{"vendor_product":"strapi:strapi","cpes":["cpe:2.3:a:strapi:strapi:3.0.0:alpha10.1:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha10.2:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha10.3:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha11.1:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha11.2:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha11.3:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha11:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1.3:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha12.1:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha12.2:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha12.3:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha12.4:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha12.5:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha12.6:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7.1:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha12.7:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha12:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha13.0.1:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha13.1:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha13:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1.1:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha14.1:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha14.2:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha14.3:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha14.4.0:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha14.5:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha14:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha15:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha16:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha17:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha18:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha19:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha20:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha21:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha22:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha23.1:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha23:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha24.1:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha24:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha25.1:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha25.2:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha25:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha26.1:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha26.2:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha26:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha4.8:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha4:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha5.3:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha5.5:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha6.3:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha6.4:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha6.7:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha7.2:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha7.3:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha8.3:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha8:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha9.1:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha9.2:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:alpha9:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta0:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta10:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta11:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta12:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta13:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta14:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta15:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta16.1:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta16.2:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta16.3:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta16.4:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta16.5:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta16.6:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta16.7:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta16.8:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta16:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta17.1:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta17.2:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta17.3:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta17.4:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta17.5:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta17.6:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta17.7:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta17.8:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta17:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta18.1:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta18.2:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta18.3:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta18:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta1:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta2:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta3:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta4:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta5:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta6:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta7:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta8:*:*:*:node.js:*:*","cpe:2.3:a:strapi:strapi:3.0.0:beta9:*:*:*:node.js:*:*"],"extracted_events":[{"introduced":"3.0.0-alpha10\\.1"},{"last_affected":"3.0.0-alpha10\\.1"},{"introduced":"3.0.0-alpha10\\.2"},{"last_affected":"3.0.0-alpha10\\.2"},{"introduced":"3.0.0-alpha10\\.3"},{"last_affected":"3.0.0-alpha10\\.3"},{"introduced":"3.0.0-alpha11"},{"last_affected":"3.0.0-alpha11"},{"introduced":"3.0.0-alpha11\\.1"},{"last_affected":"3.0.0-alpha11\\.1"},{"introduced":"3.0.0-alpha11\\.2"},{"last_affected":"3.0.0-alpha11\\.2"},{"introduced":"3.0.0-alpha11\\.3"},{"last_affected":"3.0.0-alpha11\\.3"},{"introduced":"3.0.0-alpha12"},{"last_affected":"3.0.0-alpha12"},{"introduced":"3.0.0-alpha12\\.1"},{"last_affected":"3.0.0-alpha12\\.1"},{"introduced":"3.0.0-alpha12\\.1\\.3"},{"last_affected":"3.0.0-alpha12\\.1\\.3"},{"introduced":"3.0.0-alpha12\\.2"},{"last_affected":"3.0.0-alpha12\\.2"},{"introduced":"3.0.0-alpha12\\.3"},{"last_affected":"3.0.0-alpha12\\.3"},{"introduced":"3.0.0-alpha12\\.4"},{"last_affected":"3.0.0-alpha12\\.4"},{"introduced":"3.0.0-alpha12\\.5"},{"last_affected":"3.0.0-alpha12\\.5"},{"introduced":"3.0.0-alpha12\\.6"},{"last_affected":"3.0.0-alpha12\\.6"},{"introduced":"3.0.0-alpha12\\.7"},{"last_affected":"3.0.0-alpha12\\.7"},{"introduced":"3.0.0-alpha12\\.7\\.1"},{"last_affected":"3.0.0-alpha12\\.7\\.1"},{"introduced":"3.0.0-alpha13"},{"last_affected":"3.0.0-alpha13"},{"introduced":"3.0.0-alpha13\\.0\\.1"},{"last_affected":"3.0.0-alpha13\\.0\\.1"},{"introduced":"3.0.0-alpha13\\.1"},{"last_affected":"3.0.0-alpha13\\.1"},{"introduced":"3.0.0-alpha14"},{"last_affected":"3.0.0-alpha14"},{"introduced":"3.0.0-alpha14\\.1"},{"last_affected":"3.0.0-alpha14\\.1"},{"introduced":"3.0.0-alpha14\\.1\\.1"},{"last_affected":"3.0.0-alpha14\\.1\\.1"},{"introduced":"3.0.0-alpha14\\.2"},{"last_affected":"3.0.0-alpha14\\.2"},{"introduced":"3.0.0-alpha14\\.3"},{"last_affected":"3.0.0-alpha14\\.3"},{"introduced":"3.0.0-alpha14\\.4\\.0"},{"last_affected":"3.0.0-alpha14\\.4\\.0"},{"introduced":"3.0.0-alpha14\\.5"},{"last_affected":"3.0.0-alpha14\\.5"},{"introduced":"3.0.0-alpha15"},{"last_affected":"3.0.0-alpha15"},{"introduced":"3.0.0-alpha16"},{"last_affected":"3.0.0-alpha16"},{"introduced":"3.0.0-alpha17"},{"last_affected":"3.0.0-alpha17"},{"introduced":"3.0.0-alpha18"},{"last_affected":"3.0.0-alpha18"},{"introduced":"3.0.0-alpha19"},{"last_affected":"3.0.0-alpha19"},{"introduced":"3.0.0-alpha20"},{"last_affected":"3.0.0-alpha20"},{"introduced":"3.0.0-alpha21"},{"last_affected":"3.0.0-alpha21"},{"introduced":"3.0.0-alpha22"},{"last_affected":"3.0.0-alpha22"},{"introduced":"3.0.0-alpha23"},{"last_affected":"3.0.0-alpha23"},{"introduced":"3.0.0-alpha23\\.1"},{"last_affected":"3.0.0-alpha23\\.1"},{"introduced":"3.0.0-alpha24"},{"last_affected":"3.0.0-alpha24"},{"introduced":"3.0.0-alpha24\\.1"},{"last_affected":"3.0.0-alpha24\\.1"},{"introduced":"3.0.0-alpha25"},{"last_affected":"3.0.0-alpha25"},{"introduced":"3.0.0-alpha25\\.1"},{"last_affected":"3.0.0-alpha25\\.1"},{"introduced":"3.0.0-alpha25\\.2"},{"last_affected":"3.0.0-alpha25\\.2"},{"introduced":"3.0.0-alpha26"},{"last_affected":"3.0.0-alpha26"},{"introduced":"3.0.0-alpha26\\.1"},{"last_affected":"3.0.0-alpha26\\.1"},{"introduced":"3.0.0-alpha26\\.2"},{"last_affected":"3.0.0-alpha26\\.2"},{"introduced":"3.0.0-alpha4"},{"last_affected":"3.0.0-alpha4"},{"introduced":"3.0.0-alpha4\\.8"},{"last_affected":"3.0.0-alpha4\\.8"},{"introduced":"3.0.0-alpha5\\.3"},{"last_affected":"3.0.0-alpha5\\.3"},{"introduced":"3.0.0-alpha5\\.5"},{"last_affected":"3.0.0-alpha5\\.5"},{"introduced":"3.0.0-alpha6\\.3"},{"last_affected":"3.0.0-alpha6\\.3"},{"introduced":"3.0.0-alpha6\\.4"},{"last_affected":"3.0.0-alpha6\\.4"},{"introduced":"3.0.0-alpha6\\.7"},{"last_affected":"3.0.0-alpha6\\.7"},{"introduced":"3.0.0-alpha7\\.2"},{"last_affected":"3.0.0-alpha7\\.2"},{"introduced":"3.0.0-alpha7\\.3"},{"last_affected":"3.0.0-alpha7\\.3"},{"introduced":"3.0.0-alpha8"},{"last_affected":"3.0.0-alpha8"},{"introduced":"3.0.0-alpha8\\.3"},{"last_affected":"3.0.0-alpha8\\.3"},{"introduced":"3.0.0-alpha9"},{"last_affected":"3.0.0-alpha9"},{"introduced":"3.0.0-alpha9\\.1"},{"last_affected":"3.0.0-alpha9\\.1"},{"introduced":"3.0.0-alpha9\\.2"},{"last_affected":"3.0.0-alpha9\\.2"},{"introduced":"3.0.0-beta0"},{"last_affected":"3.0.0-beta0"},{"introduced":"3.0.0-beta1"},{"last_affected":"3.0.0-beta1"},{"introduced":"3.0.0-beta10"},{"last_affected":"3.0.0-beta10"},{"introduced":"3.0.0-beta11"},{"last_affected":"3.0.0-beta11"},{"introduced":"3.0.0-beta12"},{"last_affected":"3.0.0-beta12"},{"introduced":"3.0.0-beta13"},{"last_affected":"3.0.0-beta13"},{"introduced":"3.0.0-beta14"},{"last_affected":"3.0.0-beta14"},{"introduced":"3.0.0-beta15"},{"last_affected":"3.0.0-beta15"},{"introduced":"3.0.0-beta16"},{"last_affected":"3.0.0-beta16"},{"introduced":"3.0.0-beta16\\.1"},{"last_affected":"3.0.0-beta16\\.1"},{"introduced":"3.0.0-beta16\\.2"},{"last_affected":"3.0.0-beta16\\.2"},{"introduced":"3.0.0-beta16\\.3"},{"last_affected":"3.0.0-beta16\\.3"},{"introduced":"3.0.0-beta16\\.4"},{"last_affected":"3.0.0-beta16\\.4"},{"introduced":"3.0.0-beta16\\.5"},{"last_affected":"3.0.0-beta16\\.5"},{"introduced":"3.0.0-beta16\\.6"},{"last_affected":"3.0.0-beta16\\.6"},{"introduced":"3.0.0-beta16\\.7"},{"last_affected":"3.0.0-beta16\\.7"},{"introduced":"3.0.0-beta16\\.8"},{"last_affected":"3.0.0-beta16\\.8"},{"introduced":"3.0.0-beta17"},{"last_affected":"3.0.0-beta17"},{"introduced":"3.0.0-beta17\\.1"},{"last_affected":"3.0.0-beta17\\.1"},{"introduced":"3.0.0-beta17\\.2"},{"last_affected":"3.0.0-beta17\\.2"},{"introduced":"3.0.0-beta17\\.3"},{"last_affected":"3.0.0-beta17\\.3"},{"introduced":"3.0.0-beta17\\.4"},{"last_affected":"3.0.0-beta17\\.4"},{"introduced":"3.0.0-beta17\\.5"},{"last_affected":"3.0.0-beta17\\.5"},{"introduced":"3.0.0-beta17\\.6"},{"last_affected":"3.0.0-beta17\\.6"},{"introduced":"3.0.0-beta17\\.7"},{"last_affected":"3.0.0-beta17\\.7"},{"introduced":"3.0.0-beta17\\.8"},{"last_affected":"3.0.0-beta17\\.8"},{"introduced":"3.0.0-beta18"},{"last_affected":"3.0.0-beta18"},{"introduced":"3.0.0-beta18\\.1"},{"last_affected":"3.0.0-beta18\\.1"},{"introduced":"3.0.0-beta18\\.2"},{"last_affected":"3.0.0-beta18\\.2"},{"introduced":"3.0.0-beta18\\.3"},{"last_affected":"3.0.0-beta18\\.3"},{"introduced":"3.0.0-beta2"},{"last_affected":"3.0.0-beta2"},{"introduced":"3.0.0-beta3"},{"last_affected":"3.0.0-beta3"},{"introduced":"3.0.0-beta4"},{"last_affected":"3.0.0-beta4"},{"introduced":"3.0.0-beta5"},{"last_affected":"3.0.0-beta5"},{"introduced":"3.0.0-beta6"},{"last_affected":"3.0.0-beta6"},{"introduced":"3.0.0-beta7"},{"last_affected":"3.0.0-beta7"},{"introduced":"3.0.0-beta8"},{"last_affected":"3.0.0-beta8"},{"introduced":"3.0.0-beta9"},{"last_affected":"3.0.0-beta9"}],"source":"CPE_STRING"}]},"references":[{"type":"EVIDENCE","url":"https://hackerone.com/reports/768574"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/strapi/strapi","events":[{"introduced":"0"},{"fixed":"6bb7a7f198b13b0780547285d4214704ce991c23"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"3.0.0"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:strapi:strapi:*:*:*:*:*:node.js:*:*"}}],"versions":["v3.0.0-rc.1","v3.0.0-rc.0","v3.0.0-beta.20.1","v3.0.0-beta.20","v3.0.0-beta.19.4","v3.0.0-beta.19.3","v3.0.0-beta.19.2","v3.0.0-beta.19.1","v3.0.0-beta.19","v3.0.0-beta.18.8","v3.0.0-beta.18.7","v3.0.0-beta.18.6","v3.0.0-beta.18.5","v3.0.0-beta.18.4","v3.0.0-beta.16.7","v3.0.0-beta.18.3","v3.0.0-beta.18.2","v3.0.0-beta.18.1","v3.0.0-beta.18","v3.0.0-beta.17.8","v3.0.0-beta.17.7","v3.0.0-beta.17.6","v3.0.0-beta.17.5","v3.0.0-beta.17.4","v3.0.0-beta.17.2","v3.0.0-beta.17.1","v3.0.0-beta.17","v3.0.0-beta.16.8","v3.0.0-beta.16.6","v3.0.0-beta.16.5","v3.0.0-beta.16.4","v3.0.0-beta.16.3","v3.0.0-beta.16.2","v3.0.0-beta.16.1","v3.0.0-beta.16","v3.0.0-beta.15","v3.0.0-beta.14","v3.0.0-beta.13","v3.0.0-beta.12","v3.0.0-beta.11","v3.0.0-beta.10","v3.0.0-beta.9","v3.0.0-beta.8","v3.0.0-beta.7","v3.0.0-beta.6","v3.0.0-beta.5","v3.0.0-beta.4","v3.0.0-beta.3","v3.0.0-beta.2","v3.0.0-beta.1","v3.0.0-beta.0","v3.0.0-alpha.23.1","v3.0.0-alpha.13","v3.0.0-alpha.12.7.1","v3.0.0-alpha.12.7","v3.0.0-alpha.9","v3.0.0-alpha.7.3","v3.0.0-alpha.6.7","v3.0.0-alpha.6.4","v3.0.0-alpha.4","v3.0.0-alpha.4.8","v1.5.4","v1.5.3","v1.5.2","v1.5.1","v1.5.0","v1.4.1","v1.4.0","v1.3.1","v1.3.0","v1.2.0","v1.1.0","v1.0.6","v1.0.5","v1.0.1","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-8123.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"}]}