CVE-2024-34065
Description
Strapi is an open-source content management system. By combining two vulnerabilities (an Open Redirect and session token sent as URL query parameter) in @strapi/plugin-users-permissions before version 4.24.2, is its possible of an unauthenticated attacker to bypass authentication mechanisms and retrieve the 3rd party tokens. The attack requires user interaction (one click). Unauthenticated attackers can leverage two vulnerabilities to obtain an 3rd party token and the bypass authentication of Strapi apps. Users should upgrade @strapi/plugin-users-permissions to version 4.24.2 to receive a patch.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@strapi/plugin-users-permissionsnpm | < 4.24.2 | 4.24.2 |
Affected products
3Patches
Vulnerability mechanics
References
4- github.com/strapi/strapi/security/advisories/GHSA-wrvh-rcmr-9qfcnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-wrvh-rcmr-9qfcghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-34065ghsaADVISORY
- github.com/strapi/strapi/commit/9c79921d22142a5de77ea26151550a14e4b12669ghsaWEB
News mentions
0No linked articles in our index yet.