1. Home
  2. CVE Database
  3. CVE-2023-36472
MEDIUM · 5.8

CVE-2023-36472

Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. Th...

Vulnerability Description

Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The `/content-manager/relations` route does not remove private fields or ensure that they can't be selected. This issue is fixed in version 4.11.7.

CVSS Score

5.8

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
StrapiStrapi< 4.11.7

Related Weaknesses (CWE)

CWE-200

References

FAQ

What is CVE-2023-36472?

CVE-2023-36472 is a vulnerability with a CVSS score of 5.8 (MEDIUM). Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. Th...

How severe is CVE-2023-36472?

CVE-2023-36472 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-36472?

Check the references section above for vendor advisories and patch information. Affected products include: Strapi Strapi.