Lucene search
CVE-2023-34235
Prior to Strapi 4.10.8, vulnerability allows leaking of private fields using `t(number)` prefix in Knex query leading to potential filtering attacks on admin passwords and reset-tokens
Show more
| Reporter | Title | Published | Views | Family All 8 |
|---|---|---|---|---|
 | CVE-2023-34235 | 25 Jul 202318:15 | – | nvd |
 | CVE-2023-34235 | 25 Jul 202318:15 | – | osv |
| Leaking sensitive user information still possible by filtering on private with prefix fields | 25 Jul 202317:17 | – | osv |
 | Leaking sensitive user information still possible by filtering on private with prefix fields | 25 Jul 202317:17 | – | github |
 | Information Disclosure | 26 Jul 202312:47 | – | veracode |
 | Design/Logic Flaw | 25 Jul 202318:15 | – | prion |
 | CVE-2023-34235 Leaking sensitive user information still possible by filtering on private with prefix fields | 25 Jul 202317:24 | – | vulnrichment |
 | CVE-2023-34235 Leaking sensitive user information still possible by filtering on private with prefix fields | 25 Jul 202317:24 | – | cvelist |
[
{
"vendor": "strapi",
"product": "strapi",
"versions": [
{
"version": "< 4.10.8",
"status": "affected"
}
]
}
]Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo25 Jul 2023 18:15Current
7.8High risk
Vulners AI Score7.8
CVSS37.5 - 8.6
EPSS0.01638
SSVC