Vulnerability Database
296,746
Total vulnerabilities in the database
CVE-2023-36472
Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The /content-manager/relations route does not remove private fields or ensure that they can't be selected. This issue is fixed in version 4.11.7.
| Software | From | Fixed in |
|---|---|---|
@strapi / plugin-content-manager
|
- | 4.11.7 |
|
@strapi / admin
|
- | 4.11.7 |
|
@strapi / utils
|
- | 4.11.7 |
| strapi / strapi | - | 4.11.7 |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime