CVE-2024-29181: falha de baixa gravidade em strapi
@strapi/plugin-content-manager leaks data via relations via the Admin Panel
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 2.3epss 0.4%
Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create. They should see nothing but their own items they created not all items ever created. Users should upgrade @strapi/plugin-content-manager to version 4.19.1 to receive a patch.
CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Produtos afetados
strapi · strapiCVEs relacionadas — strapi
No mesmo produto, das mais perigosas para as menos.
CVE-2026-27886CRITICALStrapi may leak sensitive data via relational filtering due to lack of query sanitizationEPSS 1.9%CVE-2026-22599CRITICALStrapi Vulnerable to SQL Injection in Content Type BuilderEPSS 1.2%CVE-2023-34235HIGHLeaking sensitive user information still possible by filtering on private with prefix fieldsEPSS 1.1%CVE-2023-38507HIGHStrapi Improper Rate Limiting vulnerabilityEPSS 1.0%CVE-2024-31217MEDIUM@strapi/plugin-upload has a Denial-of-Service via Improper Exception HandlingEPSS 0.7%CVE-2023-34093MEDIUMStrapi allows actors to make all attributes on a content-type public without noticing itEPSS 0.7%