Strapi Improper Rate Limiting vulnerability - @strapi/plugin-users-permissions - CVE-2023-38507 | SmartScanner

Description

There is a rate limit on the login function of Strapi’s admin screen, but it is possible to circumvent it.

Recommendation

Update the @strapi/plugin-users-permissions package to the latest compatible version. Followings are version details:

Affected version(s): < 4.12.1
Patched version(s): 4.12.1

References

GHSA-24q2-59hm-rh9r
CVE-2023-38507
CWE-770
CAPEC-310
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for Strapi Improper Rate Limiting vulnerability - @strapi/plugin-users-permissions and gives you actionable findings to investigate.

Start a free scan

Related Issues

Strapi Improper Rate Limiting vulnerability - CVE-2023-38507
Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying - CVE-2025-64526
Unauthorized Access to Private Fields in User Registration API - @strapi/plugin-users-permissions - CVE-2023-39345
Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin - CVE-2023-22621

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

See something that needs correcting? Let us knowUpdated November 11, 2023