CVE-2023-37263 Strapi's field level permissions not being respected in relationship title

What is CVE-2023-37263?

CVE-2023-37263 is a medium-severity vulnerability in strapi, published on 15 Sep 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title. If an actor has relationship title and the relationship shows a field they don't have permission to see, the field will still be visible. Version 4.12.1 has a fix for this issue.

Weakness: CWE-400, CWE-200

Which versions are affected by CVE-2023-37263?

2 open source packages ship an affected version, including @strapi/plugin-content-manager. It affects 1 product.

Products include Strapi Strapi.

How do I fix CVE-2023-37263?

Upgrade @strapi/plugin-content-manager to 4.12.1 or later.

Is CVE-2023-37263 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-37263 exists.

Other vulnerabilities in strapi

• CVE-2023-22894 Strapi Cleartext Storage of Sensitive Information Exploited High 7.2
• CVE-2023-22621 Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin Critical 10.0
• CVE-2022-27263 Unrestricted Upload of File with Dangerous Type in Strapi Critical 9.8
• CVE-2020-27664 Authorization bypass in Strapi Critical 9.8
• CVE-2019-18818 Strapi allows unauthenticated attacker to reset admin password without valid reset token Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m284-85mf-cgrc.