Strapi
An open-source headless CMS based on Node.js that supports REST and GraphQL APIs and can be self-hosted.
Timeline (last 90 days)
The affected products involved in the five newly added vulnerabilities are: the ProFTPD file read/write vulnerability (severity 10.0), ONLYOFFICE Docs path traversal (9.8), Apache Struts command injection (8.1), BIND denial of service (7.5), and Strapi plaintext exposure (7.2).
The Strapi vulnerability requires admin panel access in order to filter private fields, and the affected versions may already be end-of-life.
The fixed version requirements for the five vulnerabilities are: BIND 9.9.7-P2 or 9.10.2-P3 and higher, ProFTPD 1.3.5a or disabling mod_copy, Apache Struts 2.3.20.3/2.3.24.3/2.3.28.1, ONLYOFFICE 5.6.3 and higher, and Strapi 4.8.0 and higher.
Actually Asked supports three integration paths: static sites (Hugo, Jekyll, Next.js), a WordPress no-code option, and Headless CMS (Contentful, Strapi) API-first integration
Headless CMS solutions (such as Contentful and Strapi) provide content management capabilities for front-end and back-end decoupled architectures
The Headless CMS ecosystem has diverged into two camps: the SaaS hosted type represented by Contentful and Storyblok, and the open-source self-hosted type represented by Strapi and Directus.
All Facts (6)
The affected products involved in the five newly added vulnerabilities are: the ProFTPD file read/write vulnerability (severity 10.0), ONLYOFFICE Docs path traversal (9.8), Apache Struts command injection (8.1), BIND denial of service (7.5), and Strapi plaintext exposure (7.2).
50%UnverifiedThe Strapi vulnerability requires admin panel access in order to filter private fields, and the affected versions may already be end-of-life.
50%UnverifiedThe fixed version requirements for the five vulnerabilities are: BIND 9.9.7-P2 or 9.10.2-P3 and higher, ProFTPD 1.3.5a or disabling mod_copy, Apache Struts 2.3.20.3/2.3.24.3/2.3.28.1, ONLYOFFICE 5.6.3 and higher, and Strapi 4.8.0 and higher.
50%UnverifiedActually Asked supports three integration paths: static sites (Hugo, Jekyll, Next.js), a WordPress no-code option, and Headless CMS (Contentful, Strapi) API-first integration
50%UnverifiedHeadless CMS solutions (such as Contentful and Strapi) provide content management capabilities for front-end and back-end decoupled architectures
50%UnverifiedThe Headless CMS ecosystem has diverged into two camps: the SaaS hosted type represented by Contentful and Storyblok, and the open-source self-hosted type represented by Strapi and Directus.
50%