CVE-2023-36472

CVE-2023-36472 affects Strapi (before 4.11.7). The /content-manager/relations route allows an actor with the configure view permission to access private fields, including user reset password tokens, enabling information disclosure. The issue is fixed in version 4.11.7. If exploiting, the impact i...

CVE-2023-36472 Strapi may leak sensitive user information, user reset password, tokens via content-manager views

Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The /content-manager/relations route does not remove private fields or ensure that they can't be...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +46 more potentially affected by CVE-2023-36472 via @strapi/admin (>=4.0.0, <=4.11.6)

@strapi/admin NPM version =4.0.0, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.9.2, =4.9.2, =4.10.10 and more Source cves: CVE-2023-36472 Source advisory: OSV:GHSA-V8GG-4MQ2-88Q4...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +111 more potentially affected by CVE-2023-36472 via @strapi/utils (>=4.0.0, <=4.11.6)

@strapi/utils NPM version =4.0.0, =4.11.3, =4.11.2, =1.0.0, =1.5.1 - @codeparticle/strapi 4.9.2 - @codeparticle/strapi-admin 4.9.2 - @codeparticle/strapi-data-transfer 4.9.2 - @codeparticle/strapi-database 4.9.2 - @codeparticle/strapi-generators 4.9.2 - @codeparticle/strapi-permissions 4.9.2 -...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +49 more potentially affected by CVE-2023-36472 via @strapi/plugin-content-manager (>=4.0.0, <=4.11.6)

@strapi/plugin-content-manager NPM version =4.0.0, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.9.2, =4.9.2, =4.10.10 and more Source cves: CVE-2023-36472 Source advisory: OSV:GHSA-V8GG-4MQ2-88Q4...