Vulnerability · Published Jun 12, 2024 · Assigned by GitHub_M
CVE-2024-29181@strapi/plugin-content-manager leaks data via relations via the Admin Panel
Low 2.3
In plain English
A low-severity authorization bypass via user-controlled key in strapi from strapi. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create. They should see nothing but their own items they created not all items ever created. Users should upgrade @strapi/plugin-content-manager to version 4.19.1 to receive a patch.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @strapi/plugin-content-manager | 4.19.1 | GHSA-6j89-frxc-q26m |
Affected products (as reported)
Weakness: CWE-639 · Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N