Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create. They should see nothing but their own items they created not all items ever created. Users should upgrade @strapi/plugin-content-manager to version 4.19.1 to receive a patch.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Strapi |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-1951 | Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create. They should see nothing but their own items they created not all items ever created. Users should upgrade @strapi/plugin-content-manager to version 4.19.1 to receive a patch. |
 Github GHSA |
GHSA-6j89-frxc-q26m | @strapi/plugin-content-manager leaks data via relations via the Admin Panel |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 26 Sep 2024 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Strapi
Strapi strapi |
|
| CPEs | cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Strapi
Strapi strapi |
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2024-08-02T01:10:54.079Z
Reserved: 2024-03-18T17:07:00.092Z
Link: CVE-2024-29181
Vulnrichment
Updated: 2024-08-02T01:10:54.079Z
NVD
Status : Modified
Published: 2024-06-12T15:15:50.873
Modified: 2024-11-21T09:07:44.597
Link: CVE-2024-29181
Redhat
No data.
OpenCVE Enrichment
No data.