Strapi may leak sensitive user information, user reset password, tokens via content-manager views (GHSA-v8gg-4mq2-88q4)
- Severity:
- Medium
Description
I can get access to user reset password tokens if I have the configure view permissions
Recommendation
Update the @strapi/plugin-content-manager package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.11.7
- Patched version(s): 4.11.7
References
Related Issues
- @saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defst - Vulnerability
- Strapi's field level permissions not being respected in relationship title - CVE-2023-37263
- @strapi/plugin-content-manager leaks data via relations via the Admin Panel - CVE-2024-29181
- @saltcorn/plugins-loader unsanitized plugin name leads to a remote code execution (RCE) vulnerability when creating plug - Vulnerability
- Tags:
- npm
- @strapi/plugin-content-manager
Anything's wrong? Let us know Last updated on November 11, 2023