CVE-2023-39345 HIGH

CVE-2023-39345: Unauthorized Access to Private Fields in User Registration API in strapi

Vendor Strapi
Product strapi
Weakness CWE-287 · Improper authentication
Published November 6, 2023
Last update September 4, 2024
View on NVD All CVEs

CVSS base score

7.6/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity High

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

What the vulnerability does

01Description

strapi is an open-source headless CMS. Versions prior to 4.13.1 did not properly restrict write access to fielded marked as private in the user registration endpoint. As such malicious users may be able to errantly modify their user records. This issue has been addressed in version 4.13.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Key dates

02Disclosure timeline

November 6, 2023 CVE published
September 4, 2024 Record updated