CVE-2021-46440: 
JavaScript vulnerability analysis and mitigation

Strapi, before versions 3.6.9 and 4.x before 4.1.5, contains a vulnerability in its DOCUMENTATION plugin component that exposes passwords in a recoverable format. This vulnerability was disclosed on May 3, 2022, affecting multiple versions of the Strapi content management system (NVD).

The vulnerability allows an attacker to access a victim's HTTP request, obtain their cookie, and perform a base64 decode on the victim's cookie to retrieve a cleartext password. This security flaw has been assigned a CVSS v3.1 base score of 7.5 (HIGH) and a CVSS v2.0 base score of 5.0 (MEDIUM). The vulnerability is classified under CWE-522 (Insufficiently Protected Credentials) (NVD).

The successful exploitation of this vulnerability enables attackers to obtain cleartext passwords, which can then be used to access API documentation. This access could potentially lead to further API attacks, compromising the security of the affected Strapi installations (NVD).

The vulnerability has been patched in Strapi versions 3.6.9 and 4.1.5. Users are strongly advised to upgrade to these versions or later to protect against this security issue. The fix involves changes to the documentation authentication cookie system (GitHub PR).