CVE-2023-36472 - Vulnerability Details - OpenCVE

Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The `/content-manager/relations` route does not remove private fields or ensure that they can't be selected. This issue is fixed in version 4.11.7.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00137.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Strapi	Strapi

Configuration 1 [-]

cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-2598	Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The `/content-manager/relations` route does not remove private fields or ensure that they can't be selected. This issue is fixed in version 4.11.7.
Github GHSA	GHSA-v8gg-4mq2-88q4	Strapi may leak sensitive user information, user reset password, tokens via content-manager views

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/strapi/strapi/releases/tag/v4.11.7
https://github.com/strapi/strapi/security/advisories/GHSA-v8gg-4mq2-88q4

History

Wed, 25 Sep 2024 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-09-15T18:54:34.072Z

Updated: 2024-09-25T15:00:46.751Z

Reserved: 2023-06-21T18:50:41.702Z

Link: CVE-2023-36472

Vulnrichment

Updated: 2024-08-02T16:45:56.648Z

NVD

Status : Modified

Published: 2023-09-15T19:15:08.117

Modified: 2024-11-21T08:09:46.987

Link: CVE-2023-36472

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-36472", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-06-21T18:50:41.702Z", "datePublished": "2023-09-15T18:54:34.072Z", "dateUpdated": "2024-09-25T15:00:46.751Z"}, "containers": {"cna": {"title": "Strapi may leak sensitive user information, user reset password, tokens via content-manager views", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/strapi/strapi/security/advisories/GHSA-v8gg-4mq2-88q4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/strapi/strapi/security/advisories/GHSA-v8gg-4mq2-88q4"}, {"name": "https://github.com/strapi/strapi/releases/tag/v4.11.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/strapi/strapi/releases/tag/v4.11.7"}], "affected": [{"vendor": "strapi", "product": "strapi", "versions": [{"version": "< 4.11.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-09-19T16:39:09.135Z"}, "descriptions": [{"lang": "en", "value": "Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The `/content-manager/relations` route does not remove private fields or ensure that they can't be selected. This issue is fixed in version 4.11.7."}], "source": {"advisory": "GHSA-v8gg-4mq2-88q4", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T16:45:56.648Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/strapi/strapi/security/advisories/GHSA-v8gg-4mq2-88q4", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/strapi/strapi/security/advisories/GHSA-v8gg-4mq2-88q4"}, {"name": "https://github.com/strapi/strapi/releases/tag/v4.11.7", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/strapi/strapi/releases/tag/v4.11.7"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-25T15:00:22.179988Z", "id": "CVE-2023-36472", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-25T15:00:46.751Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/strapi/strapi/security/advisories/GHSA-v8gg-4mq2-88q4", "name": "https://github.com/strapi/strapi/security/advisories/GHSA-v8gg-4mq2-88q4", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/strapi/strapi/releases/tag/v4.11.7", "name": "https://github.com/strapi/strapi/releases/tag/v4.11.7", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T16:45:56.648Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-36472", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-25T15:00:22.179988Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-25T15:00:38.234Z"}}], "cna": {"title": "Strapi may leak sensitive user information, user reset password, tokens via content-manager views", "source": {"advisory": "GHSA-v8gg-4mq2-88q4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "strapi", "product": "strapi", "versions": [{"status": "affected", "version": "< 4.11.7"}]}], "references": [{"url": "https://github.com/strapi/strapi/security/advisories/GHSA-v8gg-4mq2-88q4", "name": "https://github.com/strapi/strapi/security/advisories/GHSA-v8gg-4mq2-88q4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/strapi/strapi/releases/tag/v4.11.7", "name": "https://github.com/strapi/strapi/releases/tag/v4.11.7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The `/content-manager/relations` route does not remove private fields or ensure that they can't be selected. This issue is fixed in version 4.11.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-09-19T16:39:09.135Z"}}}, "cveMetadata": {"cveId": "CVE-2023-36472", "state": "PUBLISHED", "dateUpdated": "2024-09-25T15:00:46.751Z", "dateReserved": "2023-06-21T18:50:41.702Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-09-15T18:54:34.072Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*", "matchCriteriaId": "8555152A-73A5-47F6-9322-1B280C703A56", "versionEndExcluding": "4.11.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The `/content-manager/relations` route does not remove private fields or ensure that they can't be selected. This issue is fixed in version 4.11.7."}, {"lang": "es", "value": "Strapi es un sistema de gesti\u00f3n de contenidos headless de c\u00f3digo abierto. Antes de la versi\u00f3n 4.11.7, un actor no autorizado puede obtener acceso a los tokens de restablecimiento de contrase\u00f1a del usuario si tiene permisos de visualizaci\u00f3n de la configuraci\u00f3n. La ruta `/content-manager/relations` no elimina campos privados ni garantiza que no se puedan seleccionar. Este problema se solucion\u00f3 en la versi\u00f3n 4.11.7."}], "id": "CVE-2023-36472", "lastModified": "2024-11-21T08:09:46.987", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-09-15T19:15:08.117", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/strapi/strapi/releases/tag/v4.11.7"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/strapi/strapi/security/advisories/GHSA-v8gg-4mq2-88q4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/strapi/strapi/releases/tag/v4.11.7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/strapi/strapi/security/advisories/GHSA-v8gg-4mq2-88q4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}]}