CVE-2024-56143

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the document service does not properly sanitize query parameters for private fields. An attacker can access private fields, including admin passwords and reset tokens, by crafting queries with the lookup parameter. This vulnerability is fixed in 5.5.2.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Oct 16, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-561445.4librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameters (Repla CVE-2024-561459.8Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affecte CVE-2024-56155.3The Open Graph plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.2 via the 'op CVE-2024-561569.0Halo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypass file type validat CVE-2024-561576.3iTop is an web based IT Service Management tool. Prior to versions 3.1.3 and 3.2.1, by filling malicious code in a CSV content, a cross-site CVE-2024-561589.8XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. CVE-2024-561595.3Astro is a web framework for content-driven websites. A bug in the build process allows any unauthenticated user to read parts of the server CVE-2024-56164.3A Cross-Site Request Forgery (CSRF) vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to tr CVE-2024-561617.2Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malic CVE-2024-561695.3A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI Relying Parties (such as Fort) are supposed to maintain CVE-2024-561705.3A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI manifests are listings of relevant files that clients a CVE-2024-561719.8libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlsc