CVE-2023-22893

Katalog CVE

CVSS 7.5 · High EPSS 4,1%

Kerentanan Improper Authentication pada strapi. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.

Rincian

Terbit di NVD

19 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

4,1% peluang dieksploitasi; lebih tinggi dari 90,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve exploit · advisory vendor
• https://www.ghostccamm.com/blog/multi_strapi_vulns/ exploit · advisory pihak ketiga
• https://github.com/strapi/strapi/releases release notes