Skip to content
OpenAdvisories

Package · npm

@strapi/plugin-content-manager

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.8
    CVE-2023-37263

    Strapi's field level permissions not being respected in relationship title

    Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title. If an actor has relationship title and the relationship shows a field they don't have permission to …

    strapi strapi @strapi/plugin-content-manager npm
  • Medium 5.8
    CVE-2023-36472

    Strapi may leak sensitive user information, user reset password, tokens via content-manager views

    Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The `/content-manager/relations` route does not remove privat…

    strapi strapi @strapi/admin @strapi/utils npm