PT-2024-22786 · Strapi · Strapi+1

Felixdkatt · Published 2024-06-12 · Updated 2024-09-26 · CVE-2024-29181

Positive Technologies (AI Summary)

CVSS v3.1

2.3

Low

Base vector

AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Strapi versions prior to 4.19.1

Description The issue concerns Strapi, an open-source content management system. In affected versions, when a super admin creates a collection with an item associated to another collection, a user with the Author Role can see the list of associated items they did not create. Ideally, they should only see their own items. This results in authors having access to protected data created by admins, which could include sensitive information like passwords or emails.

Recommendations For Strapi versions prior to 4.19.1, upgrade @strapi/plugin-content-manager to version 4.19.1 to receive a patch. As a temporary workaround, consider restricting access to associated items in collections to minimize the risk of unauthorized data access.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-29181

GHSA-6J89-FRXC-Q26M

Affected Products

@Strapi/Plugin-Content-Manager

Strapi

References · 8

• 🔥 https://github.com/strapi/strapi/security/advisories/GHSA-6j89-frxc-q26m · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29181.json · Exploit
• https://github.com/strapi/strapi/commit/e1dfd4d9f1cab25cf6da3614c1975e4e508e01c6 · Patch
• https://osv.dev/vulnerability/GHSA-6j89-frxc-q26m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29181 · Security Note
• https://osv.dev/vulnerability/CVE-2024-29181 · Vendor Advisory
• https://github.com/strapi/strapi · Note
• https://t.me/cvenotify/96130 · Telegram Post