p PatchFirst

PatchFirst · Latest vulnerabilities

@strapi/plugin-content-manager vulnerabilities

Vulnerabilities published for @strapi/plugin-content-manager in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 3

  1. CVE-2024-29181

    Low · CVSS 2.3EPSS 0.39%Fix available

    @strapi/plugin-content-manager leaks data via relations via the Admin Panel

    Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create. They should see nothing but their own items they created not all items ever created. Users should upgrade @strapi/plugin-content-manager to version 4.19.1 to receive a patch.

    @strapi/plugin-content-managerNode.js
    • Update to 4.19.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2023-37263

    Medium · CVSS 6.8EPSS 0.64%Fix available

    Strapi's field level permissions not being respected in relationship title

    Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title. If an actor has relationship title and the relationship shows a field they don't have permission to see, the field will still be visible. Version 4.12.1 has a fix for this issue.

    @strapi/plugin-content-managerNode.js
    • Update to 4.12.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2023-36472

    Medium · CVSS 5.8EPSS 0.67%Fix available

    Strapi may leak sensitive user information, user reset password, tokens via content-manager views

    Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The `/content-manager/relations` route does not remove private fields or ensure that they can't be selected. This issue is fixed in version 4.11.7.

    @strapi/plugin-content-managerNode.js
    • Update to 4.11.7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →