CVE-2024-31217: Insufficient Information (NVD-CWE-noinfo)
value: Strapi is an open-source content management system. Prior to version 4.22.0, a denial-of-service vulnerability is present in the media upload process causing the server to crash without restarting, affecting either development and production environments. Usually, errors in the application cause it to log the error and keep it running for other clients. This behavior, in contrast, stops the server execution, making it unavailable for any clients until it's manually restarted. Any user with access to the file upload functionality is able to exploit this vulnerability, affecting applications running in both development mode and production mode as well. Users should upgrade @strapi/plugin-upload to version 4.22.0 to receive a patch.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-12T15:15Z
Repository: https://github.com/strapi/strapi
Language: Other
Files changed: packages/core/content-releases/admin/src/components/ReleaseModal.tsx, packages/core/content-releases/admin/src/pages/ReleaseDetailsPage.tsx
Commit date: 2024-04-02 11:08:26 +0200
Commit message: fix: dont close modal on error (#19946)


Diff: diff --git a/packages/core/content-releases/admin/src/components/ReleaseModal.tsx b/packages/core/content-releases/admin/src/components/ReleaseModal.tsx
index fc203a9a4ec..d17a24deb92 100644
--- a/packages/core/content-releases/admin/src/components/ReleaseModal.tsx
+++ b/packages/core/content-releases/admin/src/components/ReleaseModal.tsx
@@ -14,11 +14,11 @@ import {
   DatePicker,
   TimePicker,
   Combobox,
   ComboboxOption,
 } from '@strapi/design-system';
-import { formatISO, parse } from 'date-fns';
+import { formatISO } from 'date-fns';
 import { utcToZonedTime, zonedTimeToUtc } from 'date-fns-tz';
 import { Formik, Form, useFormikContext } from 'formik';
 import { useIntl } from 'react-intl';
 import { useLocation } from 'react-router-dom';
 
diff --git a/packages/core/content-releases/admin/src/pages/ReleaseDetailsPage.tsx b/packages/core/content-releases/admin/src/pages/ReleaseDetailsPage.tsx
index 11c2a28dc6c..82710cd2f52 100644
--- a/packages/core/content-releases/admin/src/pages/ReleaseDetailsPage.tsx
+++ b/packages/core/content-releases/admin/src/pages/ReleaseDetailsPage.tsx
@@ -895,10 +895,11 @@ const ReleaseDetailsPage = () => {
         message: formatMessage({
           id: 'content-releases.modal.release-updated-notification-success',
           defaultMessage: 'Release updated.',
         }),
       });
+      toggleEditReleaseModal();
     } else if (isAxiosError(response.error)) {
       // When the response returns an object with 'error', handle axios error
       toggleNotification({
         type: 'warning',
         message: formatAPIError(response.error),
@@ -908,12 +909,10 @@ const ReleaseDetailsPage = () => {
       toggleNotification({
         type: 'warning',
         message: formatMessage({ id: 'notification.error', defaultMessage: 'An error occurred' }),
       });
     }
-
-    toggleEditReleaseModal();
   };
 
   const handleDeleteRelease = async () => {
     const response = await deleteRelease({
       id: releaseId,

Vulnerable code: import { formatISO, parse } from 'date-fns';

    toggleEditReleaseModal();
Fixed code: import { formatISO } from 'date-fns';
      toggleEditReleaseModal();