CVE-2022-30618
First published: Thu May 19 2022(Updated: )
An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authenticated user contain relationships to API users (from:users-permissions). There are many scenarios in which such details from API users can leak in the JSON response within the admin panel, either through a direct or indirect relationship. Access to this information enables a user to compromise these users’ accounts if the password reset API endpoints have been enabled. In a worst-case scenario, a low-privileged user could get access to a high-privileged API account, and could read and modify any data as well as block access to both the admin panel and API by revoking privileges for all other users.
Credit: disclosure@synopsys.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Strapi Strapi | >=3.0.0<3.6.10 | |
| Strapi Strapi | >=4.0.0<4.1.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2022-30618?
CVE-2022-30618 is a vulnerability that allows an authenticated user with access to the Strapi admin panel to view private and sensitive data.
How does CVE-2022-30618 affect Strapi?
CVE-2022-30618 affects Strapi versions between 3.0.0 and 3.6.10 and versions between 4.0.0 and 4.1.10.
What is the severity of CVE-2022-30618?
CVE-2022-30618 has a severity score of 7.5, which is considered high.
How can an authenticated user exploit CVE-2022-30618?
An authenticated user with access to the Strapi admin panel can exploit CVE-2022-30618 by accessing content types that contain relationships to API users and viewing private data such as email and password reset tokens.
Is there a fix for CVE-2022-30618?
Yes, users should upgrade to a version of Strapi that is not affected by CVE-2022-30618.
- collector/nvd-index
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/strapi
- canonical/strapi strapi
- version/strapi strapi/3.0.0
- version/strapi strapi/4.0.0