Vulnerabilities > CVE-2023-36472 - Unspecified vulnerability in Strapi

CVSS 5.7 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

strapi

NVD

Published: 2023-09-15

Updated: 2024-11-21

Summary

Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The `/content-manager/relations` route does not remove private fields or ensure that they can't be selected. This issue is fixed in version 4.11.7.

Vulnerable Configurations

Part	Description	Count
Application	Strapi Strapi Strapi - Strapi Strapi 0.0.1 Strapi Strapi 0.0.2 Strapi Strapi 0.0.3 Strapi Strapi 0.0.4 Strapi Strapi 0.0.5 Strapi Strapi 0.0.6 Strapi Strapi 0.0.7 Strapi Strapi 0.12.0 Strapi Strapi 0.12.1 Strapi Strapi 0.12.2 Strapi Strapi 0.12.3 Strapi Strapi 0.12.4 Strapi Strapi 1.0.0 Strapi Strapi 1.0.1 Strapi Strapi 1.0.2 Strapi Strapi 1.0.3 Strapi Strapi 1.0.4 Strapi Strapi 1.0.5 Strapi Strapi 1.0.6 Strapi Strapi 1.1.0 Strapi Strapi 1.2.0 Strapi Strapi 1.3.0 Strapi Strapi 1.3.1 Strapi Strapi 1.4.0 Strapi Strapi 1.4.1 Strapi Strapi 1.5.0 Strapi Strapi 1.5.1 Strapi Strapi 1.5.2 Strapi Strapi 1.5.3 Strapi Strapi 1.5.4 Strapi Strapi 1.5.7 Strapi Strapi 1.6.0 Strapi Strapi 1.6.1 Strapi Strapi 1.6.2 Strapi Strapi 1.6.3 Strapi Strapi 1.6.4 Strapi Strapi 3.0.0 Strapi Strapi 3.0.1 Strapi Strapi 3.0.2 Strapi Strapi 3.0.3 Strapi Strapi 3.0.4 Strapi Strapi 3.0.5 Strapi Strapi 3.2.5 Strapi Strapi 3.3.0 Strapi Strapi 3.3.1 Strapi Strapi 3.3.2 Strapi Strapi 3.3.3 Strapi Strapi 3.3.4 Strapi Strapi 3.4.0 Strapi Strapi 3.4.1 Strapi Strapi 3.4.2 Strapi Strapi 3.4.3 Strapi Strapi 3.4.4 Strapi Strapi 3.4.5 Strapi Strapi 3.4.6 Strapi Strapi 3.5.0 Strapi Strapi 3.5.1 Strapi Strapi 3.5.2 Strapi Strapi 3.5.3 Strapi Strapi 3.5.4 Strapi Strapi 3.6.0 Strapi Strapi 3.6.1 Strapi Strapi 3.6.2 Strapi Strapi 3.6.3 Strapi Strapi 3.6.4 Strapi Strapi 3.6.5 Strapi Strapi 3.6.6 Strapi Strapi 3.6.7 Strapi Strapi 3.6.8 Strapi Strapi 3.6.9 Strapi Strapi 3.6.10 Strapi Strapi 4.0.0 Strapi Strapi 4.0.1 Strapi Strapi 4.0.2 Strapi Strapi 4.0.3 Strapi Strapi 4.0.4 Strapi Strapi 4.0.5 Strapi Strapi 4.0.6 Strapi Strapi 4.0.7 Strapi Strapi 4.0.8 Strapi Strapi 4.1.0 Strapi Strapi 4.1.1 Strapi Strapi 4.1.2 Strapi Strapi 4.1.3 Strapi Strapi 4.1.4 Strapi Strapi 4.1.6 Strapi Strapi 4.1.7 Strapi Strapi 4.1.8 Strapi Strapi 4.1.9 Strapi Strapi 4.1.10 Strapi Strapi 4.1.12 Strapi Strapi 4.2.0 Strapi Strapi 4.2.2 Strapi Strapi 4.2.3 Strapi Strapi 4.3.0 Strapi Strapi 4.3.1 Strapi Strapi 4.3.2 Strapi Strapi 4.3.3 Strapi Strapi 4.3.4 Strapi Strapi 4.3.5 Strapi Strapi 4.3.6 Strapi Strapi 4.3.7 Strapi Strapi 4.3.8 Strapi Strapi 4.3.9 Strapi Strapi 4.4.0 Strapi Strapi 4.4.1 Strapi Strapi 4.4.2 Strapi Strapi 4.4.3 Strapi Strapi 4.4.4 Strapi Strapi 4.4.5 Strapi Strapi 4.4.6 Strapi Strapi 4.4.7 Strapi Strapi 4.5.0 Strapi Strapi 4.5.1 Strapi Strapi 4.5.2 Strapi Strapi 4.5.3 Strapi Strapi 4.5.4 Strapi Strapi 4.5.5 Strapi Strapi 4.5.6 Strapi Strapi 4.6.0 Strapi Strapi 4.6.1 Strapi Strapi 4.6.2 Strapi Strapi 4.7.0 Strapi Strapi 4.7.1 Strapi Strapi 4.8.0 Strapi Strapi 4.8.1 Strapi Strapi 4.8.2 Strapi Strapi 4.9.0 Strapi Strapi 4.9.1 Strapi Strapi 4.9.2 Strapi Strapi 4.10.0 Strapi Strapi 4.10.1 Strapi Strapi 4.10.2 Strapi Strapi 4.10.4 Strapi Strapi 4.10.5 Strapi Strapi 4.10.6 Strapi Strapi 4.10.7 Strapi Strapi 4.10.8 Strapi Strapi 4.11.0 Strapi Strapi 4.11.1 Strapi Strapi 4.11.2 Strapi Strapi 4.11.3 Strapi Strapi 4.11.4 Strapi Strapi 4.11.5	499

Summary

Vulnerable Configurations

References