CVE-2024-34065

CVSS V2 None CVSS V3 None
Description
Strapi is an open-source content management system. By combining two vulnerabilities (an `Open Redirect` and `session token sent as URL query parameter`) in @strapi/plugin-users-permissions before version 4.24.2, is its possible of an unauthenticated attacker to bypass authentication mechanisms and retrieve the 3rd party tokens. The attack requires user interaction (one click). Unauthenticated attackers can leverage two vulnerabilities to obtain an 3rd party token and the bypass authentication of Strapi apps. Users should upgrade @strapi/plugin-users-permissions to version 4.24.2 to receive a patch.
Overview
  • CVE ID
  • CVE-2024-34065
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-06-12T14:54:46.045Z
  • Last Modified Date
  • 2024-06-12T16:10:44.870Z
Weakness Enumerations
CWE URL
CWE-294 http://cwe.mitre.org/data/definitions/294.html
CWE-601 http://cwe.mitre.org/data/definitions/601.html
References
Reference URL Reference Tags
https://github.com/strapi/strapi/security/advisories/GHSA-wrvh-rcmr-9qfc x_refsource_CONFIRM
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2024-34065
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34065
History
Created Old Value New Value Data Type Notes
2024-06-26 14:09:16 Added to TrackCVE