CVE-2024-29181 json
@strapi/plugin-content-manager leaks data via relations via the Admin Panel
published 2024-06-12 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-1951 , GHSA-6j89-frxc-q26m
- cvss
- 2.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 32%
- public exploits
- 0
- none known
Summary
Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create. They should see nothing but their own items they created not all items ever created. Users should upgrade @strapi/plugin-content-manager to version 4.19.1 to receive a patch.
Patch / fix
- npm @strapi/plugin-content-manager 4.19.1
- strapi strapi 4.19.1
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.39% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/strapi/strapi/security/advisories/GHSA-6j89-frxc-q26m referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 2.3 | CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 2.3 | CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 3.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @strapi/plugin-content-manager | <4.19.1 |
4.19.1 |
Affected products
- strapi strapi
Classification
- Weakness
-
- CWE-639 Authorization Bypass Through User-Controlled Key
References
-
github.com
/strapi/strapi/commit/e1dfd4d9f1cab25cf6da3614c1975e4e508e01c6
web, patch
-
github.com
/strapi/strapi/security/advisories/GHSA-6j89-frxc-q26m
web, exploit, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-29181
advisory
-
github.com
/strapi/strapi
package
Sources
- CVE List CVE-2024-29181
- GitHub Advisory GHSA-6j89-frxc-q26m
- NVD CVE-2024-29181
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.