PT-2025-42484 · Strapi · Strapi

Published 2025-10-16 · Updated 2025-11-25 · CVE-2024-56143

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Strapi versions 5.0.0 through 5.5.1

Description Strapi is an open-source headless content management system. A flaw in the document service lookup does not properly sanitize query parameters for private fields. This allows an attacker to access private fields, including admin passwords and reset tokens, by crafting queries with the lookup parameter.

Recommendations Update to version 5.5.2 or later.

Exploit

Fix

LPE

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-56143

GHSA-495J-H493-42Q2

Affected Products

Strapi

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56143.json · Exploit
• https://github.com/strapi/strapi/commit/0c6e0953ae1e62afae9329de7ae6d6a5e21b95b8 · Patch
• https://github.com/strapi/strapi/security/advisories/GHSA-495j-h493-42q2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-56143 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56143 · Security Note
• https://osv.dev/vulnerability/GHSA-495j-h493-42q2 · Vendor Advisory
• https://github.com/strapi/strapi · Note
• https://twitter.com/CVEnew/status/1978926584380694654 · Twitter Post
• https://t.me/cveNotify/143963 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1978900362028351990 · Twitter Post
• https://t.me/cveNotify/139742 · Telegram Post
• https://t.me/CVEtracker/35111 · Telegram Post
• https://t.me/cveNotify/139002 · Telegram Post
• https://twitter.com/CheckmarxZero/status/1979195113621352655 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1978866401440858371 · Twitter Post