CVE-2023-36472: Exposure of Sensitive Information to an Unauthorized Actor

Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The /content-manager/relations route does not remove private fields or ensure that they can't be...

Strapi Information Disclosure Vulnerability

Strapi is an open source content management system CMS. An information disclosure vulnerability exists in Strapi versions prior to 4.11.7, which stems from an information disclosure vulnerability in which the /content-manager/relations route does not remove private fields...