CVE-2022-30618

{"id": "CVE-2022-30618", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "published": "2022-05-19T18:15:09.637", "references": [{"url": "https://www.synopsys.com/blogs/software-security/cyrc-advisory-strapi", "tags": ["Third Party Advisory"], "source": "disclosure@synopsys.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-212"}]}, {"type": "Secondary", "source": "disclosure@synopsys.com", "description": [{"lang": "en", "value": "CWE-212"}]}], "descriptions": [{"lang": "en", "value": "An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authenticated user contain relationships to API users (from:users-permissions). There are many scenarios in which such details from API users can leak in the JSON response within the admin panel, either through a direct or indirect relationship. Access to this information enables a user to compromise these users\u2019 accounts if the password reset API endpoints have been enabled. In a worst-case scenario, a low-privileged user could get access to a high-privileged API account, and could read and modify any data as well as block access to both the admin panel and API by revoking privileges for all other users."}, {"lang": "es", "value": "Un usuario autenticado con acceso al panel de administraci\u00f3n de Strapi puede visualizar datos privados y confidenciales, como el correo electr\u00f3nico y los tokens de restablecimiento de contrase\u00f1a, para los usuarios de la API si los tipos de contenido accesibles para el usuario autenticado contienen relaciones con los usuarios de la API (from:users-permissions). Se presentan muchos escenarios en los que estos detalles de los usuarios de la API pueden filtrarse en la respuesta JSON dentro del panel de administraci\u00f3n, ya sea mediante una relaci\u00f3n directa o indirecta. El acceso a esta informaci\u00f3n permite a un usuario comprometer las cuentas de estos usuarios si los endpoints de la API de restablecimiento de contrase\u00f1a han sido habilitados. En el peor de los casos, un usuario con pocos privilegios podr\u00eda acceder a una cuenta de la API con altos privilegios, y podr\u00eda leer y modificar cualquier dato, as\u00ed como bloquear el acceso tanto al panel de administraci\u00f3n como a la API al revocar los privilegios de todos los dem\u00e1s usuarios"}], "lastModified": "2022-06-06T17:29:31.270", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02E592C9-FFDC-4DB5-BF02-205DB10A18A9", "versionEndExcluding": "3.6.10", "versionStartIncluding": "3.0.0"}, {"criteria": "cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AED7B5F2-334A-4940-81DE-9F35D21AD01A", "versionEndExcluding": "4.1.10", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@synopsys.com"}