Is CVE-2022-30618 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-30618 being exploited in the wild.

How severe is CVE-2022-30618?

Low severity, with a CVSS score of 3.1, published 20 May 2022.

Which products and versions are affected?

@strapi/strapi (npm) SEMVER:introduced=0,fixed=4.1.9; strapi (npm) SEMVER:introduced=3.0.0,fixed=3.6.9.

Is there a fix for CVE-2022-30618?

Yes. @strapi/strapi (npm): upgrade to 4.1.9 or later; strapi (npm): upgrade to 3.6.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-30618 attacked?

It is attacked over the network.

Am I affected by CVE-2022-30618?

Check whether you run @strapi/strapi (npm) or strapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-30618: Strapi sensitive information disclosure in admin panel

CVE-2022-30618 · Severity: low · CVSS 3.1 · Published 2022-05-20

Strapi is a popular open-source headless CMS that provides a web-based admin panel for managing content. An authenticated admin user can view sensitive data including email addresses and password reset tokens for API users through content relationships, enabling account takeover if password reset endpoints are enabled. In the worst case, a low-privileged user could escalate to a high-privileged API account and gain full control of the system.

Technologies: @strapi/strapi (npm), strapi (npm). Vendors: npm.

Quick answers

Is CVE-2022-30618 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-30618 being exploited in the wild.
How severe is CVE-2022-30618?: Low severity, with a CVSS score of 3.1, published 20 May 2022.
Which products and versions are affected?: @strapi/strapi (npm) SEMVER:introduced=0,fixed=4.1.9; strapi (npm) SEMVER:introduced=3.0.0,fixed=3.6.9.
Is there a fix for CVE-2022-30618?: Yes. @strapi/strapi (npm): upgrade to 4.1.9 or later; strapi (npm): upgrade to 3.6.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-30618 attacked?: It is attacked over the network.
Am I affected by CVE-2022-30618?: Check whether you run @strapi/strapi (npm) or strapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@strapi/strapi (npm): upgrade to 4.1.9 or later
```
npm install @strapi/strapi@4.1.9
```
strapi (npm): upgrade to 3.6.9 or later
```
npm install strapi@3.6.9
```

Technical details

The vulnerability is a sensitive information disclosure (CWE-212) affecting Strapi versions 3.0.0–3.6.8 and 4.0.0–4.1.8. An authenticated user with admin panel access can exploit improper data filtering to view private user data (email, password reset tokens) through relationships to the users-permissions API users, either directly or indirectly. The attack requires authentication to the admin panel but no additional user interaction. Exploitation allows account compromise and privilege escalation to high-privileged roles. Fixes are available in Strapi 3.6.9 and 4.1.9 or later.

Affected products

Strapi Strapi 3.0.0–3.6.8, 4.0.0–4.1.8

Identifiers

CVE-2022-30618
GHSA-vgj7-895j-gpr6

Timeline

2022-05-20: disclosed
2022-05-20: patched: Fixes released in Strapi 3.6.9 and 4.1.9

References

https://github.com/strapi/strapi

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.