// For flags

CVE-2024-34065

@strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass

Severity Score

7.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

Strapi is an open-source content management system. By combining two vulnerabilities (an `Open Redirect` and `session token sent as URL query parameter`) in @strapi/plugin-users-permissions before version 4.24.2, is its possible of an unauthenticated attacker to bypass authentication mechanisms and retrieve the 3rd party tokens. The attack requires user interaction (one click). Unauthenticated attackers can leverage two vulnerabilities to obtain an 3rd party token and the bypass authentication of Strapi apps. Users should upgrade @strapi/plugin-users-permissions to version 4.24.2 to receive a patch.

Strapi es un sistema de gestión de contenidos de código abierto. Al combinar dos vulnerabilidades (un `Open Redirect` y un `token de sesión enviado como parámetro de consulta de URL`) en @strapi/plugin-users-permissions antes de la versión 4.24.2, es posible que un atacante no autenticado evite los mecanismos de autenticación y recupere the 3rd party tokens. El ataque requiere la interacción del usuario (un clic). Los atacantes no autenticados pueden aprovechar dos vulnerabilidades para obtener un token de terceros y evitar la autenticación de las aplicaciones Strapi. Los usuarios deben actualizar @strapi/plugin-users-permissions a la versión 4.24.2 para recibir un parche.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-04-30 CVE Reserved
  • 2024-06-12 CVE Published
  • 2024-08-02 CVE Updated
  • 2024-09-27 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-294: Authentication Bypass by Capture-replay
  • CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
CAPEC
References (1)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Strapi
Search vendor "Strapi"
Strapi
Search vendor "Strapi" for product "Strapi"
< 4.24.2
Search vendor "Strapi" for product "Strapi" and version " < 4.24.2"
en
Affected