ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2023-38507

Improper Rate Limiting

Published Sep 13, 2023 · catalog updated Sep 13, 2023 · Improper Rate Limiting

Last checked Nov 4, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2023-38507. EPSS is 0.96%. Act only if a listed version of Improper Rate Limiting is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Improper Rate Limiting).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.96%
Remediation
Version ranges on file
Affected products
cpe strapi/strapi · npm @strapi/admin · npm @strapi/plugin-users-permissions

### 1. Summary There is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. ### 2. Details It is possible to avoid this by modifying the rate-limited request path as follows. 1. Manipulating request paths to upper or lower case. (Pattern 1) - In this case, avoidance is possible with various patterns. 2. Add path slashes to the end of the request path. (Pattern 2) ### 3. PoC Access the administrator's login screen ( ) and execute the following PoC on the browser's console screen. #### Pattern 1 (uppercase and lowercase) ##### This PoC does the following: 1. Request 30 incorrect logins. 4. Execute the same request again and confirm that it is blocked by rate limit from the console screen. ( ) 5. Next, falsify the pathname of the request (** **) and make a request again to confirm that it is possible to bypass the rate limit and log in. ( ) #### Pattern 2 (trailing slash) ##### This PoC does the following: 1. Request 30 incorrect logins. 2. Execute the same request again and confirm that it is blocked by rate limit from the console screen. ( ) 3. Next, falsify the pathname of the request (** **) and make a request again to confirm that it is possible to bypass the rate limit and log in. ( ) #### PoC Video - [PoC Video](https://drive.google.com/file/d/1UHyt6UDpl28CXjltVJmqDvSEkkJIexiB/view?usp=share_link) ### 4. Impact It is possible to bypass the rate limit of the login function of the admin screen. Therefore, the possibility of unauthorized login by login brute force attack increases. ### 5. Measures Forcibly convert the request path used for rate limiting to upper case or lower case and judge it as the same path. ( ) Also, remove any extra slashes in the request path. https://github.com/strapi/strapi/blob/32d68f1f5677ed9a9a505b718c182c0a3f885426/packages/core/admin/server/middlewares/rateLimit.js#L31 ### 6. References - [OWASP: API2:2023 Broken Authentication](https://owasp.org/API-Security/editions/2023/en/0xa2-broken-au

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe strapi/strapi< 4.12.1
  • npm @strapi/admin<= 4.12.0
  • npm @strapi/plugin-users-permissions<= 4.12.0

How to fix CVE-2023-38507

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2023-38507. EPSS is 0.96%. Act only if a listed version of Improper Rate Limiting is installed.

Which versions are affected?

Compare what you have installed with < 4.12.1, <= 4.12.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-307: Improper Restriction of Excessive Authentication Attempts; CWE-770: Allocation of Resources Without Limits or Throttling. EPSS 0.96%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Strapi security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 13, 2023 · Maintainer security tabs

    Detected

    ### 1. Summary There is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. ### 2. Details It is possible to avoid this by modifying the rate-limited request path as follows. 1. Manipulating request paths to upper or lower case. (Pattern 1) - In this case, avoidance is possible with various patterns. 2. Add path slashes to the end of the request path.

Sources

  • CVE.orgVulnerability recordCVE-2023-38507

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2023-38507

    30-day exploitation probability 0.96%

    first.org
  • Maintainer security tabsVendor advisoryGHSA-24q2-59hm-rh9r

    ### 1. Summary There is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. ### 2. Details It is possible to avoid this by modifying the rate-limited request path as follows. 1. Manipulating request paths to upper or lower case. (Pattern 1) - In this case, avoidance is possible with various patterns. 2. Add path slashes to the end of the request path.

    github.com
  • Monitored products — highVendor advisoryCVE-2023-38507

    Strapi is the an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. Therefore, the possibility of unauthorized login by login brute force attack increases. Version 4.12.1 has a fix for this issue.

    nvd.nist.gov

References

Freshness

Last verified in this catalog Nov 4, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 4, 2026
  • Monitored products — highNov 4, 2026
  • CVE.orgNov 2, 2026
  • Maintainer security tabsNov 1, 2026