CVE-2023-39345 Unauthorized Access to Private Fields in User Registration API in strapi

strapi is an open-source headless CMS. Versions prior to 4.13.1 did not properly restrict write access to fielded marked as private in the user registration endpoint. As such malicious users may be able to errantly modify their user records. This issue has been addressed in version 4.13.1. Users...

Strapi Authorization Issues Vulnerability

Strapi is an open source content management system CMS. An authorization issue vulnerability exists in Strapi versions prior to 4.13.1 that stems from not properly restricting access to fields marked as private in a user's registration endpoint...

@mattie-bundle/mattie-strapi-bundle-example (>=1.0.0-alpha.2 <=1.0.0-alpha.3), sneakmax (=0.1.0) +3 more potentially affected by CVE-2023-39345 via @strapi/plugin-users-permissions (>=4.0.2 <=4.11.2)

@strapi/plugin-users-permissions NPM version =4.0.2, =1.0.0-alpha.2, =1.0.0-alpha.3 - sneakmax =0.1.0 - sneakmaxtesttemplate =0.1.0 - sneakmaxtesttemplatev2 =0.1.0 - sveltekit-strapi =0.1.0 Source cves: CVE-2023-39345 Source advisory: OSV:GHSA-GC7P-J5XM-XXH2...

@beardeddudes/strapi-types (=0.1.0), @bimbeo160/admin (=4.12.2) +33 more potentially affected by CVE-2023-39345 via @strapi/strapi (>=4.0.2 <=4.13.0)

@strapi/strapi NPM version =4.0.2, =4.12.2, =1.0.9, =1.0.0-alpha.2, =1.1.0, =4.12.4-lakileki.1, =1.0.8, =4.10.0, =4.10.0, =4.13.0-beta.0 and more Source cves: CVE-2023-39345 Source advisory: OSV:GHSA-GC7P-J5XM-XXH2...

PT-2023-26892 · Strapi · Strapi

Name of the Vulnerable Software and Affected Versions: strapi versions prior to 4.13.1 Description: strapi is an open-source headless CMS. The issue arises from the improper restriction of write access to fields marked as private in the user registration endpoint. This allows malicious users to...

Strapi Cognito Provider Authentication Bypass

Strapi is a popular open-source headless CMS built with Node.js. Strapi versions after 3.2.0 and before 4.6.0 suffer from a lack of validation of JWT tokens sent through the AWS Cognito authentication provider during the OAuth flow. By forging a custom JWT token with any signature, a remote and...

CVE-2023-38507

Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. Therefore, the possibility of unauthorized login by login brute force attack increases. Version 4.12...

Design/Logic Flaw

Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. Therefore, the possibility of unauthorized login by login brute force attack increases. Version 4.12...

CVE-2023-36472

Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The /content-manager/relations route does not remove private fields or ensure that they can't be...

CVE-2023-37263

Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title. If an actor has relationship title and the relationship shows a field they don't have permission to see, the field will still be visible...

CVE-2023-38507 Strapi Improper Rate Limiting vulnerability

Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. Therefore, the possibility of unauthorized login by login brute force attack increases. Version 4.12...

CVE-2023-38507 Strapi Improper Rate Limiting vulnerability

Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. Therefore, the possibility of unauthorized login by login brute force attack increases. Version 4.12...

CVE-2023-38507

CVE-2023-38507 affects Strapi up to version 4.12.0 (prior to 4.12.1) and describes an improper rate-limiting mechanism on the admin login that could be circumvented, enabling brute-force login attempts. Multiple connected documents corroborate that the vulnerability stems from a login-rate-limit ...

CVE-2023-38507 Strapi Improper Rate Limiting vulnerability

Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. Therefore, the possibility of unauthorized login by login brute force attack increases. Version 4.12...

Design/Logic Flaw

Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The /content-manager/relations route does not remove private fields or ensure that they can't be...

Design/Logic Flaw

Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title. If an actor has relationship title and the relationship shows a field they don't have permission to see, the field will still be visible...

CVE-2023-37263 Strapi's field level permissions not being respected in relationship title

Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title. If an actor has relationship title and the relationship shows a field they don't have permission to see, the field will still be visible...

CVE-2023-37263

CVE-2023-37263 affects Strapi (open-source headless CMS). The issue: field-level permissions are not respected in the relationship title, causing a field the user should not see to be visible when a relation includes that field. Impact is described as information disclosure under older releases. ...

CVE-2023-37263 Strapi's field level permissions not being respected in relationship title

Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title. If an actor has relationship title and the relationship shows a field they don't have permission to see, the field will still be visible...

CVE-2023-37263 Strapi's field level permissions not being respected in relationship title

Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title. If an actor has relationship title and the relationship shows a field they don't have permission to see, the field will still be visible...