PT-2023-24666 · Strapi · Strapi
Marc-Roig
·
Published
2023-07-25
·
Updated
2023-08-03
·
CVE-2023-34093
CVSS v3.1
4.8
Medium
| Vector | AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Strapi versions prior to 4.10.8
Description
The issue affects the handling of content types by Strapi, allowing anyone to make every attribute of a Content-Type public without knowing it. This can lead to sensitive information being exposed or the entire system being taken control of by an attacker, having access to password hashes. The vulnerability occurs when users use plugins or modify their own content types, potentially removing the
privateAttributes getter, which can result in any attribute becoming public. Everyone can be impacted, depending on how people are using or extending content-types, except those who are mutating the content-type.Recommendations
For versions prior to 4.10.8, update to version 4.10.8 to resolve the issue. As a temporary workaround, consider avoiding the use of plugins or modifying content types that could potentially remove the
privateAttributes getter, and ensure that any modifications to content types are done with caution to prevent unintended exposure of attributes.Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Strapi