CVE-2022-30617

Severity Score

8.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship (e.g., created by, updated by) with content accessible to the authenticated user. For example, a low-privileged “author” role account can view these details in the JSON response for an “editor” or “super admin” that has updated one of the author’s blog posts. There are also many other scenarios where such details from other users can leak in the JSON response, either through a direct or indirect relationship. Access to this information enables a user to compromise other users’ accounts by successfully invoking the password reset workflow. In a worst-case scenario, a low-privileged user could get access to a “super admin” account with full control over the Strapi instance, and could read and modify any data as well as block access to both the admin panel and API by revoking privileges for all other users.

Un usuario autenticado con acceso al panel de administración de Strapi puede visualizar datos privados y confidenciales, como el correo electrónico y los tokens de restablecimiento de contraseña, para otros usuarios del panel de administración que tengan una relación (por ejemplo, creado por, actualizado por) con el contenido accesible para el usuario autenticado. Por ejemplo, una cuenta de rol "author" con pocos privilegios puede visualizar estos detalles en la respuesta JSON para un "editor" o "super admin" que haya actualizado una de las entradas del blog del autor. También se presentan muchos otros escenarios donde estos detalles de otros usuarios pueden filtrarse en la respuesta JSON, ya sea mediante una relación directa o indirecta. El acceso a esta información permite a un usuario comprometer las cuentas de otros usuarios al invocar con éxito el flujo de trabajo de restablecimiento de contraseña. En el peor de los casos, un usuario con pocos privilegios podría acceder a una cuenta "super admin" con control total sobre la instancia de Strapi, y podría leer y modificar cualquier dato, así como bloquear el acceso tanto al panel de administración como a la API al revocar los privilegios de todos los demás usuarios

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-05-12 CVE Reserved
2022-05-19 CVE Published
2023-12-10 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer

CAPEC

References (1)

URL	Tag	Source
https://www.synopsys.com/blogs/software-security/cyrc-advisory-strapi	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Strapi Search vendor "Strapi"		Strapi Search vendor "Strapi" for product "Strapi"				>= 3.0.0 < 3.6.10 Search vendor "Strapi" for product "Strapi" and version " >= 3.0.0 < 3.6.10"		-		Affected
Strapi Search vendor "Strapi"		Strapi Search vendor "Strapi" for product "Strapi"				4.0.0 Search vendor "Strapi" for product "Strapi" and version "4.0.0"		beta10		Affected
Strapi Search vendor "Strapi"		Strapi Search vendor "Strapi" for product "Strapi"				4.0.0 Search vendor "Strapi" for product "Strapi" and version "4.0.0"		beta11		Affected
Strapi Search vendor "Strapi"		Strapi Search vendor "Strapi" for product "Strapi"				4.0.0 Search vendor "Strapi" for product "Strapi" and version "4.0.0"		beta12		Affected
Strapi Search vendor "Strapi"		Strapi Search vendor "Strapi" for product "Strapi"				4.0.0 Search vendor "Strapi" for product "Strapi" and version "4.0.0"		beta13		Affected
Strapi Search vendor "Strapi"		Strapi Search vendor "Strapi" for product "Strapi"				4.0.0 Search vendor "Strapi" for product "Strapi" and version "4.0.0"		beta14		Affected
Strapi Search vendor "Strapi"		Strapi Search vendor "Strapi" for product "Strapi"				4.0.0 Search vendor "Strapi" for product "Strapi" and version "4.0.0"		beta15		Affected
Strapi Search vendor "Strapi"		Strapi Search vendor "Strapi" for product "Strapi"				4.0.0 Search vendor "Strapi" for product "Strapi" and version "4.0.0"		beta2		Affected
Strapi Search vendor "Strapi"		Strapi Search vendor "Strapi" for product "Strapi"				4.0.0 Search vendor "Strapi" for product "Strapi" and version "4.0.0"		beta3		Affected
Strapi Search vendor "Strapi"		Strapi Search vendor "Strapi" for product "Strapi"				4.0.0 Search vendor "Strapi" for product "Strapi" and version "4.0.0"		beta4		Affected
Strapi Search vendor "Strapi"		Strapi Search vendor "Strapi" for product "Strapi"				4.0.0 Search vendor "Strapi" for product "Strapi" and version "4.0.0"		beta5		Affected
Strapi Search vendor "Strapi"		Strapi Search vendor "Strapi" for product "Strapi"				4.0.0 Search vendor "Strapi" for product "Strapi" and version "4.0.0"		beta6		Affected
Strapi Search vendor "Strapi"		Strapi Search vendor "Strapi" for product "Strapi"				4.0.0 Search vendor "Strapi" for product "Strapi" and version "4.0.0"		beta7		Affected
Strapi Search vendor "Strapi"		Strapi Search vendor "Strapi" for product "Strapi"				4.0.0 Search vendor "Strapi" for product "Strapi" and version "4.0.0"		beta8		Affected
Strapi Search vendor "Strapi"		Strapi Search vendor "Strapi" for product "Strapi"				4.0.0 Search vendor "Strapi" for product "Strapi" and version "4.0.0"		beta9		Affected