CVE-2023-36472

I can get access to user reset password tokens if I have the configure view permissions

Details

/content-manager/relations route does not remove private fields or ensure that they can't be selected

PoC

Install fresh strapi instance
start up strapi and create an account
create a new content-type
give the content-type a relation with admin users and save
go to Admin panel roles Author and then plugins.
Enable for content-manager collection types the configure view
In the collection time now only give them access to the collection you created for this.
Create a new admin user account with the Author role
Log out and request a password reset for the main admin user.
Login on the newly created account
go to the collection type you created for this test and click the create new entry button,
click in the create new entry view on configure view.
select the admin user relation we created click on resetPasswordToken
Now go back to the create an entry view and when selection the relation we created we now see the reset tokken

Impact is that the none admin user now has the reset token of the admin users account and can resets its password using that to escalate his privilege's

Still you need the configure view permission to be able to escalate your privilege's

CVE-2023-36472 has a CVSS score of 5.8 (Medium). The vector is network-reachable, low privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (4.11.7); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2023-36472? CVE-2023-36472 is a medium-severity security vulnerability in @strapi/plugin-content-manager (npm), affecting versions < 4.11.7. It is fixed in 4.11.7.
2. How severe is CVE-2023-36472? CVE-2023-36472 has a CVSS score of 5.8 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which packages are affected by CVE-2023-36472?
   • @strapi/plugin-content-manager (npm) (versions < 4.11.7)
   • @strapi/admin (npm) (versions < 4.11.7)
   • @strapi/utils (npm) (versions < 4.11.7)
4. Is there a fix for CVE-2023-36472? Yes. CVE-2023-36472 is fixed in 4.11.7. Upgrade to this version or later.
5. Is CVE-2023-36472 exploitable, and should I be worried? Whether CVE-2023-36472 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2023-36472 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2023-36472?
   • Upgrade @strapi/plugin-content-manager to 4.11.7 or later
   • Upgrade @strapi/admin to 4.11.7 or later
   • Upgrade @strapi/utils to 4.11.7 or later