CVE-2023-37263
Strapi's field level permissions not being respected in relationship title
Résumé
Strapi's field level permissions not being respected in relationship title
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Strapi is the an open-source headless content management system. Prior to version 4.12.1, field level permissions are not respected in the relationship title. If an actor has relationship title and the relationship shows a field they don't have permission to see, the field will still be visible. Version 4.12.1 has a fix for this issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com