Description
In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) routes.
Remediation
References
https://github.com/strapi/strapi/pull/8439
https://github.com/strapi/strapi/releases/tag/v3.2.5
Related Vulnerabilities
CVE-2021-39177 Vulnerability in maven package org.geysermc:connector
CVE-2018-14042 Vulnerability in maven package org.fujion.webjars:bootstrap
CVE-2022-23496 Vulnerability in maven package nl.basjes.parse.useragent:yauaa
CVE-2023-32071 Vulnerability in maven package org.xwiki.platform:xwiki-platform-web-templates