github.com
https://github.com/strapi/strapi CVE-2023-37263
MEDIUM
Strapi's field level permissions not being respected in relationship title
Record summary
CVE-2023-37263 has a selected CVSS score of 6.8 (medium).
Description
Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title. If an actor has relationship title and the relationship shows a field they don't have permission to see, the field will still be visible. Version 4.12.1 has a fix for this issue.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 25, 2024 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
strapiBrowse strapi / strapi | CVE List | < 4.12.1 | affected |
@strapi/plugin-content-managerBrowse npm / @strapi/plugin-content-manager | GitHub Advisory | Before 4.12.1 · Fixed in 4.12.1 | affected |
References
4github.com
https://github.com/strapi/strapi/releases/tag/v4.12.1 github.comConfirmation
https://github.com/strapi/strapi/security/advisories/GHSA-m284-85mf-cgrc nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2023-37263