Authorization Flaw in Strapi Content-Type Builder Routes
CVE-2020-27665

7.5HIGH

Key Information:

Vendor

Strapi

Status
Strapi
Vendor
CVE Published:
22 October 2020

What is CVE-2020-27665?

In versions of Strapi prior to 3.2.5, there exists an authorization flaw in the content-type-builder routes due to a lack of the admin::hasPermissions restriction. This could potentially allow unauthorized users to access sensitive routes, leading to severe security implications. Users and administrators should ensure they update to version 3.2.5 or later to mitigate this risk.

References

https://github.com/strapi/strapi/releases/tag/v3.2.5
x_refsource_MISC
https://github.com/strapi/strapi/pull/8439
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.