Description
If a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force.
Affected versions: < 1.7.0
Recommendation
Update the payload package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.7.0
- Patched version(s): 1.7.0
References
Related Issues
- Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) - CVE-2023-34092
- Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS) - CVE-2023-25653
- tagify can pass a malicious placeholder to initiate the cross-site scripting (XSS) payload - CVE-2022-25854
- Leaking sensitive user information still possible by filtering on private with prefix fields - @strapi/database - CVE-2023-34235
You might also like:
- Tags:
- npm
- payload
Anything's wrong? Let us know Last updated on November 11, 2023