-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @strapi/plugin-content-manager | npm | < 4.11.7 | 4.11.7 |
| @strapi/admin | npm | < 4.11.7 | 4.11.7 |
| @strapi/utils | npm | < 4.11.7 | 4.11.7 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from two key failures: 1) The relations controller endpoint (findRelations) allows selection of sensitive fields through the UI's configure view feature without proper authorization checks. 2) The output sanitization process (sanitizeOutput) doesn't adequately remove private fields from admin user relations. This matches the described attack pattern where users with configure permissions can expose resetPasswordToken through relation selection. The functions are inferred from Strapi's architecture where content-manager handles relations and entity management handles output sanitization, with the CVE description specifically implicating the relations route and field selection mechanisms.