CVE-2023-37263: Field level permissions not being respected in relationship title

September 15, 2023 (updated September 20, 2023)

Strapi is an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title. If an actor has relationship title and the relationship shows a field they don’t have permission to see, the field will still be visible. Version 4.12.1 has a fix for this issue.

References

github.com/strapi/strapi/releases/tag/v4.12.1
github.com/strapi/strapi/security/advisories/GHSA-m284-85mf-cgrc
nvd.nist.gov/vuln/detail/CVE-2023-37263

Code Behaviors & Features

Detect and mitigate CVE-2023-37263 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →