Is CVE-2023-36472 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-36472 being exploited in the wild.

How severe is CVE-2023-36472?

Low severity, with a CVSS score of 3.1, published 13 September 2023.

Which products and versions are affected?

@strapi/admin (npm) SEMVER:introduced=0,fixed=4.11.7; @strapi/plugin-content-manager (npm) SEMVER:introduced=0,fixed=4.11.7; @strapi/utils (npm) SEMVER:introduced=0,fixed=4.11.7; Strapi Admin < 4.11.7; and 1 more.

Is there a fix for CVE-2023-36472?

Yes. @strapi/admin (npm): upgrade to 4.11.7 or later; @strapi/plugin-content-manager (npm): upgrade to 4.11.7 or later; @strapi/utils (npm): upgrade to 4.11.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-36472 attacked?

It is attacked over the network.

Am I affected by CVE-2023-36472?

Check whether you run @strapi/admin (npm), @strapi/plugin-content-manager (npm), @strapi/utils (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-36472: Strapi information disclosure in content-manager relations view

Q: Is there a fix for CVE-2023-36472?

Yes. @strapi/admin (npm): upgrade to 4.11.7 or later; @strapi/plugin-content-manager (npm): upgrade to 4.11.7 or later; @strapi/utils (npm): upgrade to 4.11.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2023-36472 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2023-36472?

Check whether you run @strapi/admin (npm), @strapi/plugin-content-manager (npm), @strapi/utils (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-36472 · Severity: low · CVSS 3.1 · Published 2023-09-13

Strapi is a headless CMS platform used to manage and deliver content to applications. A vulnerability in the content-manager plugin allows users with limited administrative permissions (Author role with configure view access) to view sensitive fields like password reset tokens that should be private, potentially enabling account takeover of higher-privileged admin accounts.

Technologies: @strapi/admin (npm), @strapi/plugin-content-manager (npm), @strapi/utils (npm), Strapi Admin. Vendors: npm, Strapi.

Quick answers

Is CVE-2023-36472 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-36472 being exploited in the wild.
How severe is CVE-2023-36472?: Low severity, with a CVSS score of 3.1, published 13 September 2023.
Which products and versions are affected?: @strapi/admin (npm) SEMVER:introduced=0,fixed=4.11.7; @strapi/plugin-content-manager (npm) SEMVER:introduced=0,fixed=4.11.7; @strapi/utils (npm) SEMVER:introduced=0,fixed=4.11.7; Strapi Admin < 4.11.7; and 1 more.
Is there a fix for CVE-2023-36472?: Yes. @strapi/admin (npm): upgrade to 4.11.7 or later; @strapi/plugin-content-manager (npm): upgrade to 4.11.7 or later; @strapi/utils (npm): upgrade to 4.11.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-36472 attacked?: It is attacked over the network.
Am I affected by CVE-2023-36472?: Check whether you run @strapi/admin (npm), @strapi/plugin-content-manager (npm), @strapi/utils (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@strapi/admin (npm): upgrade to 4.11.7 or later
```
npm install @strapi/admin@4.11.7
```
@strapi/plugin-content-manager (npm): upgrade to 4.11.7 or later
```
npm install @strapi/plugin-content-manager@4.11.7
```
@strapi/utils (npm): upgrade to 4.11.7 or later
```
npm install @strapi/utils@4.11.7
```

Technical details

The vulnerability exists in the /content-manager/relations endpoint, which fails to filter out or restrict access to private fields when returning relation data. An attacker with Author role permissions and content-manager configure view access can craft requests to view admin user relations and access sensitive fields such as resetPasswordToken. The attack requires specific role configuration and user interaction but results in exposure of authentication tokens. This is a CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) vulnerability that allows privilege escalation by obtaining an admin's password reset token and changing their password. The vulnerability was fixed in version 4.11.7.

Affected products

Strapi Admin < 4.11.7
Strapi Content-Manager Plugin < 4.11.7
Strapi Utils < 4.11.7

Identifiers

CVE-2023-36472
GHSA-v8gg-4mq2-88q4

Timeline

2023-09-13: disclosed
2023-09-13: patched: Version 4.11.7 released with fix

References

https://github.com/strapi/strapi/security/advisories/GHSA-v8gg-4mq2-88q4

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.