Authentication flaw

The Strapi Protected Populate Plugin protects get endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate those fields anyway. This issue has bee...

CVE-2023-48218

The CVE-2023-48218 issue affects the Strapi Protected Populate Plugin. Pre-1.3.4 versions allowed bypassing field-level security by populating fields the user should not access on get endpoints. It has been patched in version 1.3.4; no workarounds are documented. CVSSv3.1 base score 5.3 (NETWORK,...

CVE-2023-48218 Strapi Protected Populate Plugin leaking fields if the request fields where empty or only fields selected where not populatable

The Strapi Protected Populate Plugin protects get endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate those fields anyway. This issue has bee...

Strapi Security Vulnerabilities

Strapi is an open source content management system CMS. A security vulnerability exists in Strapi Protected Populate Plugin versions prior to 1.3.4. An attacker could exploit the vulnerability to populate certain fields...

PT-2023-30736 · Strapi · Strapi Protected Populate Plugin

Name of the Vulnerable Software and Affected Versions: Strapi Protected Populate Plugin versions prior to 1.3.4 Description: The issue allows users to bypass field level security, enabling them to populate fields they do not have access to. This affects get endpoints, which are protected by the...

Strapi < 4.8.0 Private Fields Sensitive Information Disclosure

Strapi is a popular open-source headless Content Management System CMS written in Node.js. Strapi versions before 4.8.0 suffer from an information disclosure vulnerability through collections private fields. By manipulating public collections query filters, a remote and unauthenticated attacker c...

CVE-2023-39345

strapi is an open-source headless CMS. Versions prior to 4.13.1 did not properly restrict write access to fielded marked as private in the user registration endpoint. As such malicious users may be able to errantly modify their user records. This issue has been addressed in version 4.13.1. Users...

Design/Logic Flaw

strapi is an open-source headless CMS. Versions prior to 4.13.1 did not properly restrict write access to fielded marked as private in the user registration endpoint. As such malicious users may be able to errantly modify their user records. This issue has been addressed in version 4.13.1. Users...

CVE-2023-39345 Unauthorized Access to Private Fields in User Registration API in strapi

strapi is an open-source headless CMS. Versions prior to 4.13.1 did not properly restrict write access to fielded marked as private in the user registration endpoint. As such malicious users may be able to errantly modify their user records. This issue has been addressed in version 4.13.1. Users...

CVE-2023-39345

CVE-2023-39345 affects the Strapi open‑source CMS. According to the sources, versions prior to 4.13.1 did not properly restrict write access to fields marked as private in the user registration endpoint, allowing a malicious user to modify their own records. The issue is addressed in version 4.13...

CVE-2023-39345 Unauthorized Access to Private Fields in User Registration API in strapi

strapi is an open-source headless CMS. Versions prior to 4.13.1 did not properly restrict write access to fielded marked as private in the user registration endpoint. As such malicious users may be able to errantly modify their user records. This issue has been addressed in version 4.13.1. Users...

CVE-2023-39345 Unauthorized Access to Private Fields in User Registration API in strapi

strapi is an open-source headless CMS. Versions prior to 4.13.1 did not properly restrict write access to fielded marked as private in the user registration endpoint. As such malicious users may be able to errantly modify their user records. This issue has been addressed in version 4.13.1. Users...

Strapi Authorization Issues Vulnerability

Strapi is an open source content management system CMS. An authorization issue vulnerability exists in Strapi versions prior to 4.13.1 that stems from not properly restricting access to fields marked as private in a user's registration endpoint...

@chargeover/strapi (0.0.1-rc1.1), @code-mancers/strapi-plugin-stellate (>=1.0.0, <=1.4.3) +11 more potentially affected by CVE-2023-39345 via @strapi/plugin-users-permissions (>=4.0.0-beta.0, <=4.11.2)

@strapi/plugin-users-permissions NPM version =4.0.0-beta.0, =1.0.0, =1.0.0-alpha.0, =2.1.0, =1.0.0, =1.0.2 - easylaser-vn-cms 0.1.0 - sneakmax 0.1.0 - sneakmaxtesttemplate 0.1.0 - sneakmaxtesttemplatev2 0.1.0 - strapi-ent-a 0.1.0 - strapi-fcm 0.1.0 - strapi-voting 0.2.1 - sveltekit-strapi 0.1.0...

@beardeddudes/strapi-types (0.1.0), @bimbeo160/admin (4.12.2) +59 more potentially affected by CVE-2023-39345 via @strapi/strapi (>=4.0.0-beta.0, <=4.13.0-beta.0)

@strapi/strapi NPM version =4.0.0-beta.0, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.9.2, =4.9.2, =1.0.5, =2.0.13 and more Source cves: CVE-2023-39345 Source advisory: OSV:GHSA-GC7P-J5XM-XXH2...

PT-2023-26892 · Strapi · Strapi

Name of the Vulnerable Software and Affected Versions: strapi versions prior to 4.13.1 Description: strapi is an open-source headless CMS. The issue arises from the improper restriction of write access to fields marked as private in the user registration endpoint. This allows malicious users to...

Strapi Cognito Provider Authentication Bypass

Strapi is a popular open-source headless CMS built with Node.js. Strapi versions after 3.2.0 and before 4.6.0 suffer from a lack of validation of JWT tokens sent through the AWS Cognito authentication provider during the OAuth flow. By forging a custom JWT token with any signature, a remote and...

CVE-2023-38507

Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. Therefore, the possibility of unauthorized login by login brute force attack increases. Version 4.12...

Design/Logic Flaw

Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. Therefore, the possibility of unauthorized login by login brute force attack increases. Version 4.12...

CVE-2023-36472

Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The /content-manager/relations route does not remove private fields or ensure that they can't be...