{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-20T23:53:05.012","vulnerabilities":[{"cve":{"id":"CVE-2023-38507","sourceIdentifier":"security-advisories@github.com","published":"2023-09-15T20:15:08.997","lastModified":"2024-11-21T08:13:43.200","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. Therefore, the possibility of unauthorized login by login brute force attack increases. Version 4.12.1 has a fix for this issue."},{"lang":"es","value":"Strapi es un sistema de gestión de contenidos headless de código abierto. Antes de la versión 4.12.1, había un límite de velocidad en la función de inicio de sesión de la pantalla de administración de Strapi, pero es posible evitarlo. Por lo tanto, aumenta la posibilidad de un inicio de sesión no autorizado mediante un ataque de fuerza bruta. La versión 4.12.1 tiene una solución para este problema."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*","versionEndExcluding":"4.12.1","matchCriteriaId":"F8A80799-A87E-41E1-9D7B-9F27E85A29BD"}]}]}],"references":[{"url":"https://github.com/strapi/strapi/blob/32d68f1f5677ed9a9a505b718c182c0a3f885426/packages/core/admin/server/middlewares/rateLimit.js#L31","source":"security-advisories@github.com","tags":["Issue Tracking"]},{"url":"https://github.com/strapi/strapi/releases/tag/v4.12.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/strapi/strapi/security/advisories/GHSA-24q2-59hm-rh9r","source":"security-advisories@github.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/strapi/strapi/blob/32d68f1f5677ed9a9a505b718c182c0a3f885426/packages/core/admin/server/middlewares/rateLimit.js#L31","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking"]},{"url":"https://github.com/strapi/strapi/releases/tag/v4.12.1","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes"]},{"url":"https://github.com/strapi/strapi/security/advisories/GHSA-24q2-59hm-rh9r","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}}]}