Is CVE-2023-37263 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-37263 being exploited in the wild.

How severe is CVE-2023-37263?

Low severity, with a CVSS score of 3.1, published 13 September 2023.

Which products and versions are affected?

@strapi/plugin-content-manager (npm) SEMVER:introduced=0,fixed=4.12.1.

Is there a fix for CVE-2023-37263?

Yes. @strapi/plugin-content-manager (npm): upgrade to 4.12.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-37263 attacked?

It is attacked over the network.

Am I affected by CVE-2023-37263?

Check whether you run @strapi/plugin-content-manager (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-37263: Strapi field level permissions bypass in relationship title

CVE-2023-37263 · Severity: low · CVSS 3.1 · Published 2023-09-13

Strapi is a headless CMS used to manage and serve content to applications. A flaw in how the system enforces role-based access controls (RBAC) allows an authenticated admin user with restricted permissions to view sensitive data fields they should not have access to when those fields are displayed as relationship titles. This could leak confidential information selected by administrators, such as user details or other protected fields, to users with limited roles.

Technologies: @strapi/plugin-content-manager (npm). Vendors: npm.

Quick answers

Is CVE-2023-37263 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-37263 being exploited in the wild.
How severe is CVE-2023-37263?: Low severity, with a CVSS score of 3.1, published 13 September 2023.
Which products and versions are affected?: @strapi/plugin-content-manager (npm) SEMVER:introduced=0,fixed=4.12.1.
Is there a fix for CVE-2023-37263?: Yes. @strapi/plugin-content-manager (npm): upgrade to 4.12.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-37263 attacked?: It is attacked over the network.
Am I affected by CVE-2023-37263?: Check whether you run @strapi/plugin-content-manager (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@strapi/plugin-content-manager (npm): upgrade to 4.12.1 or later
```
npm install @strapi/plugin-content-manager@4.12.1
```

Technical details

This vulnerability is an authorization bypass in the @strapi/plugin-content-manager package where field-level RBAC checks are not properly enforced on relationship endpoints. An attacker with high-privilege credentials (an admin account) but restricted field-level permissions can navigate the content manager to view relationship data and observe fields that their role explicitly denies access to. The vulnerability requires network access and authenticated admin credentials with at least partial role permissions. An authenticated user with low privileges can thus bypass field-level access controls to read sensitive data displayed in relationship titles. The issue is fixed in version 4.12.1 and later.

Affected products

Strapi @strapi/plugin-content-manager <= 4.12.0

Identifiers

CVE-2023-37263
GHSA-m284-85mf-cgrc

Timeline

2023-09-13: disclosed
2023-09-13: patched: Version 4.12.1 released with fix

References

https://github.com/strapi/strapi/security/advisories/GHSA-m284-85mf-cgrc

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.