CVE-2024-29181 @strapi/plugin-content-manager leaks data via relations via the Admin Panel
An Author role user can view associated items in collections they did not create, leading to unauthorized data disclosure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-29181?
CVE-2024-29181 is a low-severity missing authorization vulnerability in strapi, published on 12 Jun 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create. They should see nothing but their own items they created not all items ever created. Users should upgrade @strapi/plugin-content-manager to version 4.19.1 to receive a patch.
Weakness: CWE-639
Which versions are affected by CVE-2024-29181?
2 open source packages ship an affected version, including @strapi/plugin-content-manager. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@strapi/plugin-content-manager npm | All versions | 4.19.1 |
@strapi/plugin-content-manager npm | All versions | 4.19.1 |
Products include Strapi Strapi.
How do I fix CVE-2024-29181?
Upgrade @strapi/plugin-content-manager to 4.19.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-29181 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-29181 exists.
Other vulnerabilities in strapi
- CVE-2023-22894 Strapi Cleartext Storage of Sensitive Information
- CVE-2023-22621 Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin
- CVE-2022-27263 Unrestricted Upload of File with Dangerous Type in Strapi
- CVE-2020-27664 Authorization bypass in Strapi
- CVE-2019-18818 Strapi allows unauthenticated attacker to reset admin password without valid reset token
Sources
Also known as GHSA-6j89-frxc-q26m.