CVE-2023-38507
Strapi Improper Rate Limiting vulnerability
Severity Score
9.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Attend
*SSVC
Descriptions
Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. Therefore, the possibility of unauthorized login by login brute force attack increases. Version 4.12.1 has a fix for this issue.
Strapi es un sistema de gestión de contenidos headless de código abierto. Antes de la versión 4.12.1, había un límite de velocidad en la función de inicio de sesión de la pantalla de administración de Strapi, pero es posible evitarlo. Por lo tanto, aumenta la posibilidad de un inicio de sesión no autorizado mediante un ataque de fuerza bruta. La versión 4.12.1 tiene una solución para este problema.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Attend
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-07-18 CVE Reserved
- 2023-09-15 CVE Published
- 2024-09-25 CVE Updated
- 2024-09-25 First Exploit
- 2024-10-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-770: Allocation of Resources Without Limits or Throttling
CAPEC
References (3)
| URL | Date | SRC |
|---|---|---|
| https://github.com/strapi/strapi/security/advisories/GHSA-24q2-59hm-rh9r | 2024-09-25 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|