PT-2023-24666 · Strapi · Strapi
Marc-Roig
·
Publicado
2023-07-25
·
Atualizado
2023-08-03
·
CVE-2023-34093
CVSS v3.1
4.8
Média
| Vetor | AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Strapi versions prior to 4.10.8
Description
The issue affects the handling of content types by Strapi, allowing anyone to make every attribute of a Content-Type public without knowing it. This can lead to sensitive information being exposed or the entire system being taken control of by an attacker, having access to password hashes. The vulnerability occurs when users use plugins or modify their own content types, potentially removing the
privateAttributes getter, which can result in any attribute becoming public. Everyone can be impacted, depending on how people are using or extending content-types, except those who are mutating the content-type.Recommendations
For versions prior to 4.10.8, update to version 4.10.8 to resolve the issue. As a temporary workaround, consider avoiding the use of plugins or modifying content types that could potentially remove the
privateAttributes getter, and ensure that any modifications to content types are done with caution to prevent unintended exposure of attributes.Exploit
Correção
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Strapi