CVE-2023-36472 Strapi may leak sensitive user information, user reset password, tokens via content-manager views

Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The /content-manager/relations route does not remove private fields or ensure that they can't be...

CVE-2023-36472 Strapi may leak sensitive user information, user reset password, tokens via content-manager views

Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The /content-manager/relations route does not remove private fields or ensure that they can't be...

CVE-2023-36472

CVE-2023-36472 affects Strapi (before 4.11.7). The /content-manager/relations route allows an actor with the configure view permission to access private fields, including user reset password tokens, enabling information disclosure. The issue is fixed in version 4.11.7. If exploiting, the impact i...

Information Disclosure

Strapi is vulnerable to Sensitive Information Disclosure. This vulnerability is due to the /content-manager/relations route which does not mask private fields. An attacker can exploit this vulnerability to disclose sensitive information such as password tokens, user information etc...

Improper Authorization

@strapi/plugin-content-manager is vulnerable to Improper Authorization. The vulnerability is due to Field level permissions not being respected in the relationship title, as there are no RBAC permission checks to read the field in relations.js...

Strapi Information Disclosure Vulnerability

Strapi is an open source content management system CMS. An information disclosure vulnerability exists in Strapi version 4.12.0 and earlier, which stems from an RBAC field that can disclose administrator user information...

Strapi Information Disclosure Vulnerability

Strapi is an open source content management system CMS. An information disclosure vulnerability exists in Strapi versions prior to 4.11.7, which stems from an information disclosure vulnerability in which the /content-manager/relations route does not remove private fields...

Strapi Security Vulnerabilities

Strapi is an open source content management system CMS. A security vulnerability exists in Strapi version 4.12.1 and earlier, which stems from a rate limitation in the login function that allows an attacker to perform an unauthorized login via brute force attack...

@mattie-bundle/mattie-strapi-bundle-example (>=1.0.0-alpha.0 <=1.0.0-alpha.3), sneakmax (=0.1.0) +3 more potentially affected by CVE-2023-38507 via @strapi/plugin-users-permissions (>=4.0.0-beta.0 <=4.11.2)

@strapi/plugin-users-permissions NPM version =4.0.0-beta.0, =1.0.0-alpha.0, =1.0.0-alpha.3 - sneakmax =0.1.0 - sneakmaxtesttemplate =0.1.0 - sneakmaxtesttemplatev2 =0.1.0 - sveltekit-strapi =0.1.0 Source cves: CVE-2023-38507 Source advisory: OSV:GHSA-24Q2-59HM-RH9R...

Strapi Improper Rate Limiting vulnerability

Summary There is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. 2. Details It is possible to avoid this by modifying the rate-limited request path as follows. 1. Manipulating request paths to upper or lower case. Pattern 1 - In this case,...

@beardeddudes/strapi-types (=0.1.0), @mattie-bundle/mattie-strapi-bundle-example (>=1.0.0-alpha.0 <=1.0.0-alpha.3) +20 more potentially affected by CVE-2023-38507 via @strapi/admin (>=0.0.0-a230f29587d4a221c9c686ca4e467b3fb465631a <=4.12.0)

@strapi/admin NPM version =0.0.0-a230f29587d4a221c9c686ca4e467b3fb465631a, =1.0.0-alpha.0, =0.0.0-experimental.0a47d9bbb261b49ab02af2597ede27b7bdb196f4, =0.0.0-00c0da0e5db43d5de823f6193c9a3fa0dd11a364, =0.0.0-02d487e4eec68a5961817a4f580ffead9a9362f0,...

@beardeddudes/strapi-types (=0.1.0), @mattie-bundle/mattie-strapi-bundle-example (>=1.0.0-alpha.0 <=1.0.0-alpha.3) +20 more potentially affected by CVE-2023-37263 via @strapi/plugin-content-manager (>=0.0.0-a230f29587d4a221c9c686ca4e467b3fb465631a <=4.12.0)

@strapi/plugin-content-manager NPM version =0.0.0-a230f29587d4a221c9c686ca4e467b3fb465631a, =1.0.0-alpha.0, =0.0.0-00c0da0e5db43d5de823f6193c9a3fa0dd11a364, =0.0.0-00c0da0e5db43d5de823f6193c9a3fa0dd11a364, =0.0.0-02d487e4eec68a5961817a4f580ffead9a9362f0,...

Strapi's field level permissions not being respected in relationship title

Summary Field level permissions not being respected in relationship title. If I have a relationship title and the relationship shows a field I don't have permission to see I will still be visible. Details No RBAC checks on on the relationship the relation endpoint returns PoC Setup Create a fresh...

GHSA-M284-85MF-CGRC Strapi's field level permissions not being respected in relationship title

Summary Field level permissions not being respected in relationship title. If I have a relationship title and the relationship shows a field I don't have permission to see I will still be visible. Details No RBAC checks on on the relationship the relation endpoint returns PoC Setup Create a fresh...

@beardeddudes/strapi-types (=0.1.0), @mattie-bundle/mattie-strapi-bundle-example (>=1.0.0-alpha.0 <=1.0.0-alpha.3) +17 more potentially affected by CVE-2023-36472 via @strapi/plugin-content-manager (>=0.0.0-a230f29587d4a221c9c686ca4e467b3fb465631a <=4.11.6)

@strapi/plugin-content-manager NPM version =0.0.0-a230f29587d4a221c9c686ca4e467b3fb465631a, =1.0.0-alpha.0, =0.0.0-00c0da0e5db43d5de823f6193c9a3fa0dd11a364, =0.0.0-00c0da0e5db43d5de823f6193c9a3fa0dd11a364, =0.0.0-02d487e4eec68a5961817a4f580ffead9a9362f0,...

@beardeddudes/strapi-types (=0.1.0), @buit-public/provider-upload-local-custom (=4.11.4) +67 more potentially affected by CVE-2023-36472 via @strapi/utils (>=0.0.0-a230f29587d4a221c9c686ca4e467b3fb465631a <=4.11.6)

@strapi/utils NPM version =0.0.0-a230f29587d4a221c9c686ca4e467b3fb465631a, =4.11.3, =4.11.2, =1.0.0-beta, =1.0.0-alpha.0, =0.1.2, =0.0.0-00a3f69152eb918683ed5c05bfed9c45495c0a87, =0.0.0-experimental.0a47d9bbb261b49ab02af2597ede27b7bdb196f4,...

Strapi may leak sensitive user information, user reset password, tokens via content-manager views

Summary I can get access to user reset password tokens if I have the configure view permissions Details /content-manager/relations route does not remove private fields or ensure that they can't be selected PoC Install fresh strapi instance start up strapi and create an account create a new...

GHSA-V8GG-4MQ2-88Q4 Strapi may leak sensitive user information, user reset password, tokens via content-manager views

Summary I can get access to user reset password tokens if I have the configure view permissions Details /content-manager/relations route does not remove private fields or ensure that they can't be selected PoC Install fresh strapi instance start up strapi and create an account create a new...

@beardeddudes/strapi-types (=0.1.0), @mattie-bundle/mattie-strapi-bundle-example (>=1.0.0-alpha.0 <=1.0.0-alpha.3) +17 more potentially affected by CVE-2023-36472 via @strapi/admin (>=0.0.0-a230f29587d4a221c9c686ca4e467b3fb465631a <=4.11.6)

@strapi/admin NPM version =0.0.0-a230f29587d4a221c9c686ca4e467b3fb465631a, =1.0.0-alpha.0, =0.0.0-experimental.0a47d9bbb261b49ab02af2597ede27b7bdb196f4, =0.0.0-00c0da0e5db43d5de823f6193c9a3fa0dd11a364, =0.0.0-02d487e4eec68a5961817a4f580ffead9a9362f0,...

Information Disclosure

@strapi/utils is vulnerable to Information Disclosure. The vulnerability exists because the private fields are not properly handled which allows an attacker to filter the fields and gain access to sensitive information...