CVE-2023-36472 Strapi may leak sensitive user information, user reset password, tokens via content-manager views
Unauthorized users with view permissions can access sensitive password reset tokens and private fields via the content-manager relations route.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-36472?
CVE-2023-36472 is a medium-severity vulnerability in strapi, published on 15 Sep 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The `/content-manager/relations` route does not remove private fields or ensure that they can't be selected. This issue is fixed in version 4.11.7.
Weakness: CWE-200
Which versions are affected by CVE-2023-36472?
6 open source packages ship an affected version, including @strapi/admin, @strapi/plugin-content-manager and @strapi/utils. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@strapi/admin npm | All versions | 4.11.7 |
@strapi/admin npm | All versions | 4.11.7 |
@strapi/plugin-content-manager npm | All versions | 4.11.7 |
@strapi/plugin-content-manager npm | All versions | 4.11.7 |
@strapi/utils npm | All versions | 4.11.7 |
@strapi/utils npm | All versions | 4.11.7 |
Products include Strapi Strapi.
How do I fix CVE-2023-36472?
Upgrade @strapi/admin to 4.11.7 or later.
Is CVE-2023-36472 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-36472 exists.
Other vulnerabilities in strapi
- CVE-2023-22894 Strapi Cleartext Storage of Sensitive Information
- CVE-2023-22621 Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin
- CVE-2022-27263 Unrestricted Upload of File with Dangerous Type in Strapi
- CVE-2020-27664 Authorization bypass in Strapi
- CVE-2019-18818 Strapi allows unauthenticated attacker to reset admin password without valid reset token
Sources
Also known as GHSA-v8gg-4mq2-88q4.