CVE-2025-53092

{
  "id": "CVE-2025-53092",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-16T17:15:33.727",
  "lastModified": "2026-10-19T17:10:00.173",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper validation or whitelisting. This allows an attacker-controlled site to send credentialed requests to the Strapi backend. An attacker can exploit this by hosting a malicious site on a different origin (e.g., different port) and sending requests with credentials to the Strapi API. The vulnerability is fixed in version 5.20.0. No known workarounds exist."
    },
    {
      "lang": "es",
      "value": "Strapi es un sistema de gestión de contenido headless de código abierto. Las versiones de Strapi anteriores a la 5.20.0 contienen una vulnerabilidad de mala configuración de CORS en instalaciones predeterminadas. Por defecto, Strapi refleja el valor del encabezado Origin en el encabezado de respuesta Access-Control-Allow-Origin sin una validación o lista blanca adecuadas. Esto permite que un sitio controlado por un atacante envíe solicitudes con credenciales al backend de Strapi. Un atacante puede explotar esto al alojar un sitio malicioso en un origen diferente (por ejemplo, un puerto diferente) y enviar solicitudes con credenciales a la API de Strapi. La vulnerabilidad está corregida en la versión 5.20.0. No existen soluciones alternativas conocidas."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "strapi",
          "product": "strapi",
          "versions": [
            {
              "version": "< 5.20.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-16T18:03:56.017150Z",
          "id": "CVE-2025-53092",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-284"
        },
        {
          "lang": "en",
          "value": "CWE-364"
        },
        {
          "lang": "en",
          "value": "CWE-942"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "5.20.0",
              "matchCriteriaId": "4129AF63-8F53-43D6-8E8E-DB0FB979FF0D"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/strapi/strapi/security/advisories/GHSA-9329-mxxw-qwf8",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}