CVE-2024-29181

Katalog CVE

CVSS 3.5 · Low EPSS 0,39%

Kerentanan Authorization Bypass Through User-Controlled Key pada strapi. Skor CVSS 3.1 3.5 (Low) menurut NVD.

Deskripsi (NVD)

Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create. They should see nothing but their own items they created not all items ever created. Users should upgrade @strapi/plugin-content-manager to version 4.19.1 to receive a patch.

Rincian

Terbit di NVD

12 Juni 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

3.5 (Low), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 30,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/strapi/strapi/security/advisories/GHSA-6j89-frxc-q26m exploit · advisory vendor
• https://github.com/strapi/strapi/commit/e1dfd4d9f1cab25cf6da3614c1975e4e508e01c6 patch