CVE-2023-36472
Fixed upstream EPSS <1%CVSS 5.8
Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The `/content-manager/relations` route does not remove private fields or ensure that they can't be selected. This issue is fixed in version 4.11.7.
Products: Strapi
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | @strapi/admin | 4.11.7 |
| npm | @strapi/plugin-content-manager | 4.11.7 |
| npm | @strapi/utils | 4.11.7 |