strapi @strapi/utils vulnerabilities

Latest strapi @strapi/utils CVEs

Newest publication first

1. CVE-2023-36472 Strapi may leak sensitive user information, user reset password, tokens via content-manager views

   Published 2023-09-15

   Medium·CVSS 5.7 EPSS 0.67%

   Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The /content-manager/relations route does not remove private fields or ensure that...

2. CVE-2023-34235 Leaking sensitive user information still possible by filtering on private with prefix fields

   Published 2023-07-25

   High·CVSS 7.5 EPSS 1.1%

   Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the t(number) prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it...

3. CVE-2023-34093 Strapi allows actors to make all attributes on a content-type public without noticing it

   Published 2023-07-25

   High·CVSS 7.1 EPSS 0.72%

   Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone (Strapi developers, users, plugins) can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types by Strapi, not the a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.