CVE-2023-38507 Strapi Improper Rate Limiting vulnerability

What is CVE-2023-38507?

CVE-2023-38507 is a high-severity vulnerability in strapi, published on 15 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. Therefore, the possibility of unauthorized login by login brute force attack increases. Version 4.12.1 has a fix for this issue.

Weakness: CWE-770

Which versions are affected by CVE-2023-38507?

4 open source packages ship an affected version, including @strapi/admin and @strapi/plugin-users-permissions. It affects 1 product.

Products include Strapi Strapi.

How do I fix CVE-2023-38507?

Upgrade @strapi/admin to 4.12.1 or later.

Is CVE-2023-38507 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-38507 exists.

Other vulnerabilities in strapi

• CVE-2023-22894 Strapi Cleartext Storage of Sensitive Information Exploited High 7.2
• CVE-2023-22621 Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin Critical 10.0
• CVE-2022-27263 Unrestricted Upload of File with Dangerous Type in Strapi Critical 9.8
• CVE-2020-27664 Authorization bypass in Strapi Critical 9.8
• CVE-2019-18818 Strapi allows unauthenticated attacker to reset admin password without valid reset token Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-24q2-59hm-rh9r.