Strapi 是一種以 Node.js 撰寫的熱門開放原始碼無週邊內容管理系統 (CMS)。Strapi 4.8.0 之前版本受到透過集合私密欄位造成的資訊洩漏弱點影響。未經驗證的遠端攻擊者可以操控公開集合查詢篩選器，透過分析回應差異來推斷敏感資訊，例如加密密碼或密碼重設權杖。一旦刺探利用成功，攻擊者可取得 Strapi 管理面板的管理存取權。

Strapi 是一种以 Node.js 编写的常用开源无头内容管理系统 (CMS)。4.8.0 之前的 Strapi 版本会受到集合私有字段造成的信息泄露漏洞的影响。通过操纵公共集合查询筛选器，未经身份验证的远程攻击者可通过分析响应差异推断敏感信息，如加密的密码或密码重置标记。成功利用漏洞后，攻击者可获得 Strapi 管理面板的管理权限。

Strapi は、Node.js で記述された一般的なオープンソースのヘッドレスコンテンツ管理システム (CMS) です。4.8.0 より前のバージョンの Strapi は、コレクションのプライベートフィールドを介した情報漏洩の脆弱性の影響を受けます。認証されていないリモート攻撃者が、パブリックコレクションのクエリフィルターを操作することで、応答の不一致を分析し、暗号化されたパスワードやパスワードリセットトークンなどの機密情報を推測する可能性があります。悪用に成功した場合、攻撃者は Strapi 管理パネルへの管理者アクセス権を取得できます。

Strapi is a popular open-source headless Content Management System (CMS) written in Node.js. Strapi versions before 4.8.0 suffer from an information disclosure vulnerability through collections private fields. By manipulating public collections query filters, a remote and unauthenticated attacker can infer sensitive information like encrypted password or password reset tokens by analyzing response discrepancies. Upon successful exploitation, the attacker can gain administrative access to the Strapi administration panel.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details
    by exploiting the query filter. The attacker can filter users by columns that contain sensitive
    information and infer a value from API responses. If the attacker has super admin access, then this can be
    exploited to discover the password hash and password reset token of all users. If the attacker has admin
    panel access to an account with permission to access the username and email of API users with a lower
    privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for
    all API users but not other admin accounts. (CVE-2023-22894)

ID	Name	Product	Family	Published	Updated	Severity
114108	Strapi < 4.8.0 私密欄位敏感資訊洩漏	Web App Scanning	Component Vulnerability	11/15/2023	5/27/2024	medium
114108	Strapi < 4.8.0 私有字段敏感信息泄露	Web App Scanning	Component Vulnerability	11/15/2023	5/27/2024	medium
114108	Strapi < 4.8.0 プライベートフィールドの機密情報漏洩	Web App Scanning	Component Vulnerability	11/15/2023	5/27/2024	medium
114108	Strapi < 4.8.0 Private Fields Sensitive Information Disclosure	Web App Scanning	Component Vulnerability	11/15/2023	5/27/2024	medium
416435	SCA: security update for @strapi/strapi (GHSA-jjqf-j4w7-92w8)	Tenable Self-Hosted Container Security	SCA Checks	1/23/2025	10/9/2026	medium
416435	SCA: security update for @strapi/strapi (GHSA-jjqf-j4w7-92w8)	Tenable Cloud Security	SCA Checks	1/23/2025	10/9/2026	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium