Description
If a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force.
Affected versions: < 1.7.0
Recommendation
Update the payload package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.7.0
- Patched version(s): 1.7.0
References
Related Issues
- matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms - CVE-2023-38700
- javascript-deobfuscator crafted payload can lead to code execution - CVE-2024-36120
- Leaking sensitive user information still possible by filtering on private with prefix fields - CVE-2023-34235
- Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS) - CVE-2023-25653
You might also like:
- Tags:
- npm
- payload
Anything's wrong? Let us know Last updated on November 11, 2023