Vulnerability Database
296,147
Total vulnerabilities in the database
CVE-2023-36472
Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The /content-manager/relations route does not remove private fields or ensure that they can't be selected. This issue is fixed in version 4.11.7.
| Software | From | Fixed in |
|---|---|---|
@strapi / plugin-content-manager
|
- | 4.11.7 |
|
@strapi / admin
|
- | 4.11.7 |
|
@strapi / utils
|
- | 4.11.7 |
| strapi / strapi | - | 4.11.7 |