Description
If a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force.
Affected versions: < 1.7.0
Recommendation
Update the payload package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.7.0
- Patched version(s): 1.7.0
References
Could your website be exposed too?
SmartScanner can check your website for Hidden fields can be leaked on readable collections in Payload and gives you actionable findings to investigate.
Start a free scanRelated Issues
- matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms - CVE-2023-38700
- javascript-deobfuscator crafted payload can lead to code execution - CVE-2024-36120
- Leaking sensitive user information still possible by filtering on private with prefix fields - CVE-2023-34235
- Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS) - CVE-2023-25653
You might also like:
See something that needs correcting? Let us knowUpdated November 11, 2023