Authentication Bypass

🗓️ 27 Apr 2023 13:12:18Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 24 Views

@strapi/plugin-users-permissions is vulnerable to Authentication Bypass. Library doesn't check access or ID tokens from `AWS Cognito` OAuth flow. Remote attacker can impersonate users

Reporter	Title	Published	Views	Family All 16
Circl	CVE-2023-22893	18 Apr 202309:12	–	circl
CNNVD	Strapi 授权问题漏洞	19 Apr 202300:00	–	cnnvd
CVE	CVE-2023-22893	19 Apr 202300:00	–	cve
Cvelist	CVE-2023-22893	19 Apr 202300:00	–	cvelist
Github Security Blog	Strapi does not verify the access or ID tokens issued during the OAuth flow	19 Apr 202318:33	–	github
Nuclei	Strapi Versions <=4.5.6 - Authentication Bypass	21 Jun 202603:03	–	nuclei
NVD	CVE-2023-22893	19 Apr 202316:15	–	nvd
OSV	GHSA-583X-23H9-F5W7 Strapi does not verify the access or ID tokens issued during the OAuth flow	19 Apr 202318:33	–	osv
Prion	Authentication flaw	19 Apr 202316:15	–	prion
Positive Technologies	PT-2023-18757 · Amazon · Aws Cognito	18 Apr 202300:00	–	ptsecurity

Vulners

Node

plugin-users-permissions @strapi/plugin-users-permissionsRange4.2.2–4.6.0-beta.2js

plugin-users-permissions @strapi/plugin-users-permissionsRange4.1.4-alpha.0–4.2.1-alpha.0js

plugin-users-permissions @strapi/plugin-users-permissionsRange4.0.0-beta.0–4.1.3js

Source	Link
github	www.github.com/strapi/strapi/pull/15382
github	www.github.com/strapi/strapi/commit/d0edd25ceb49d275d710bf8d59999a2c07072893
github	www.github.com/advisories/GHSA-xv3q-jrmm-4fxv
github	www.github.com/strapi/strapi/releases
strapi	www.strapi.io/blog/security-disclosure-of-vulnerabilities-cve
ghostccamm	www.ghostccamm.com/blog/multi_strapi_vulns/

05 Feb 2025 19:29Current

7.4High risk

Vulners AI Score7.4

CVSS 3.17.5

EPSS0.04158

SSVC