CVE-2024-29181 @strapi/plugin-content-manager leaks data via relations via the Admin Panel

2024-06-1214:46:04

CWE-639

GitHub_M

www.cve.org

cve-2024-29181

strapi

content management system

data leak

super admin

collection

association

user role

upgrade

patch

2.3 Low

CVSS3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

0.0004 Low

EPSS

Percentile

9.0%

JSON

Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create. They should see nothing but their own items they created not all items ever created. Users should upgrade @strapi/plugin-content-manager to version 4.19.1 to receive a patch.

CNA Affected

[
  {
    "vendor": "strapi",
    "product": "strapi",
    "versions": [
      {
        "version": "< 4.19.1",
        "status": "affected"
      }
    ]
  }
]