github.com
https://github.com/strapi/strapi CVE-2023-39345
HIGH
Unauthorized Access to Private Fields in User Registration API in strapi
Record summary
CVE-2023-39345 has a selected CVSS score of 7.6 (high).
Description
strapi is an open-source headless CMS. Versions prior to 4.13.1 did not properly restrict write access to fielded marked as private in the user registration endpoint. As such malicious users may be able to errantly modify their user records. This issue has been addressed in version 4.13.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 4, 2024 · Source: CVE List
Affected products and versions
3| Product | Source | Version range | Status |
|---|---|---|---|
strapiBrowse strapi / strapiDefault status: unknown | CVE List | 4.0.0 to < 4.13.1 | affected |
| >= 4.0.0, < 4.13.1 | affected | ||
@strapi/plugin-users-permissionsBrowse npm / @strapi/plugin-users-permissions | GitHub Advisory | 4.0.0 to < 4.13.1 · Fixed in 4.13.1 | affected |
@strapi/strapiBrowse npm / @strapi/strapi | GitHub Advisory | 4.0.0 to < 4.13.1 · Fixed in 4.13.1 | affected |
References
4github.comConfirmation
https://github.com/strapi/strapi/security/advisories/GHSA-gc7p-j5xm-xxh2 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2023-39345 strapi.io
https://strapi.io/blog/security-disclosure-of-vulnerabilities-sept-2023