CVE-2023-36472

Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The "/content-manager/relations" route does not remove private fields or ensure that they can't be...

Strapi Information Disclosure Vulnerability

Strapi is an open source content management system CMS. An information disclosure vulnerability exists in Strapi versions prior to 4.11.7, which stems from an information disclosure vulnerability in which the /content-manager/relations route does not remove private fields...

CVE-2023-36472: Exposure of Sensitive Information to an Unauthorized Actor

Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The /content-manager/relations route does not remove private fields or ensure that they can't be...

PT-2023-25582

Name of the Vulnerable Software and Affected Versions Strapi versions prior to 4.11.7 Description The issue allows an unauthorized actor to access user reset password tokens if they have configure view permissions. The /content-manager/relations route does not remove private fields or ensure that...