Description

AWS Cognito login provider of Strapi is vulnerable to an authentication bypass vulnerability due to a lack of JWT signature verification. It allows unauthenticated users to compromise the system.

Remediation

Upgrade to the latest version of Strapi

References

Security Disclosure of Vulnerabilities: CVE-2023-22893, CVE-2023-22621, and CVE-2023-22894

Multiple Critical Vulnerabilities in Strapi Versions <=4.7.1

Related Vulnerabilities

WordPress Plugin FancyBox for WordPress Security Bypass (3.0.2)

WordPress Plugin Job Manager Security Bypass (0.7.25)

WordPress Plugin Calendar Event Multi View Security Bypass (1.4.13)

WordPress Plugin Email Subscribers by Icegram Express-Email Marketing, Newsletters, Automation for WordPress & WooCommerce Security Bypass (5.7.13)

Joomla! Core 3.x.x Security Bypass (3.2.0 - 3.9.4)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Authentication Bypass CWE-287 CVE-2023-22893