CVE-2023-22893

CVSS V2 None CVSS V3 None

Description

Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.

Overview

CVE ID
CVE-2023-22893

Assigner
cve@mitre.org

Vulnerability Status
Undergoing Analysis

Published Version
2023-04-19T16:15:07

Last Modified Date
2023-04-19T19:52:18

References

Reference URL	Reference Tags
https://github.com/strapi/strapi/releases
https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve
https://www.ghostccamm.com/blog/multi_strapi_vulns/

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-22893
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22893

History

Created	Old Value	New Value	Data Type	Notes
2023-04-19 17:01:19				Added to TrackCVE
2023-04-19 20:01:31		2023-04-19T19:52:18	CVE Modified Date	updated
2023-04-19 20:01:31	Received	Awaiting Analysis	Vulnerability Status	updated
2023-04-26 11:00:42	Awaiting Analysis	Undergoing Analysis	Vulnerability Status	updated