PT-2023-25582 · Strapi · Strapi

Boegie19 · Published 2023-09-13 · Updated 2023-09-21 · CVE-2023-36472

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Strapi versions prior to 4.11.7

Description The issue allows an unauthorized actor to access user reset password tokens if they have configure view permissions. The /content-manager/relations route does not remove private fields or ensure that they can't be selected. This can lead to privilege escalation, as a non-admin user can obtain the reset token of an admin user's account and use it to reset the password.

Recommendations For versions prior to 4.11.7, update to version 4.11.7 to resolve the issue. As a temporary workaround, consider restricting access to the /content-manager/relations route or disabling the configure view permission for non-admin users until the update is applied.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-36472

GHSA-V8GG-4MQ2-88Q4

Affected Products

Strapi

References · 8

• 🔥 https://github.com/strapi/strapi/security/advisories/GHSA-v8gg-4mq2-88q4 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36472.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-36472 · Security Note
• https://osv.dev/vulnerability/CVE-2023-36472 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v8gg-4mq2-88q4 · Vendor Advisory
• https://github.com/strapi/strapi · Note
• https://github.com/strapi/strapi/releases/tag/v4.11.7 · Note
• https://t.me/cibsecurity/70609 · Telegram Post