Description
An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authenticated user contain relationships to API users (from:users-permissions).
Recommendation
Update the @strapi/strapi package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.1.9
- Patched version(s): 4.1.9
References
Could your website be exposed too?
SmartScanner can check your website for Improper Removal of Sensitive Information Before Storage or Transfer in Strapi and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Improper Removal of Sensitive Information Before Storage or Transfer in Strapi - @strapi/strapi - CVE-2022-30617
- Strapi leaking sensitive user information by filtering on private fields - CVE-2023-22894
- Strapi may leak sensitive user information, user reset password, tokens via content-manager views - CVE-2023-36472
- Strapi may leak sensitive user information, user reset password, tokens via content-manager views - @strapi/utils - CVE-2023-36472
You might also like:
See something that needs correcting? Let us knowUpdated January 27, 2023