Information Disclosure

@strapi/utils, @strapi/strapi and @strapi/database is vulnerable to Information Disclosure. The vulnerability exists due to the use of getters for private attributes which allows an attacker to view sensitive attributes because the privateAttributes may be removed unintentionally...

CVE-2023-34235

Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the tnumber prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to...

Design/Logic Flaw

Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the tnumber prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to...

CVE-2023-34235 Leaking sensitive user information still possible by filtering on private with prefix fields

Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the tnumber prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to...

CVE-2023-34235 Leaking sensitive user information still possible by filtering on private with prefix fields

Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the tnumber prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to...

CVE-2023-34235

Strapi (pre-4.10.8) is vulnerable to information disclosure due to a Knex query that allows changing the default field prefix (t(number)). If the t-number prefix is used, private fields like password can be exposed, as t1.password is not protected. The issue can lead to filtering attacks affectin...

CVE-2023-34235 Leaking sensitive user information still possible by filtering on private with prefix fields

Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the tnumber prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to...

@exfabrica/strapi-plugin-awesome-seo (>=1.0.0-beta <=1.0.0-beta.1.2), @mattie-bundle/mattie-strapi-bundle-example (>=1.0.0-alpha.0 <=1.0.0-alpha.3) +54 more potentially affected by CVE-2023-34093 via @strapi/utils (>=0.0.0-a230f29587d4a221c9c686ca4e467b3fb465631a <=4.10.8-exp.0)

@strapi/utils NPM version =0.0.0-a230f29587d4a221c9c686ca4e467b3fb465631a, =1.0.0-beta, =1.0.0-alpha.0, =0.1.2, =0.0.0-00a3f69152eb918683ed5c05bfed9c45495c0a87, =0.0.0-experimental.0a47d9bbb261b49ab02af2597ede27b7bdb196f4, =0.0.0-experimental.0a47d9bbb261b49ab02af2597ede27b7bdb196f4,...

@mattie-bundle/mattie-strapi-bundle-example (>=1.0.0-alpha.0 <=1.0.0-alpha.3), @mv0409/strapis (=4.0.6) +16 more potentially affected by CVE-2023-34093 via @strapi/database (>=0.0.0-a230f29587d4a221c9c686ca4e467b3fb465631a <=4.10.8-exp.0)

@strapi/database NPM version =0.0.0-a230f29587d4a221c9c686ca4e467b3fb465631a, =1.0.0-alpha.0, =0.0.0-00c0da0e5db43d5de823f6193c9a3fa0dd11a364, =0.0.0-experimental.0a47d9bbb261b49ab02af2597ede27b7bdb196f4, =0.0.0-experimental.0a47d9bbb261b49ab02af2597ede27b7bdb196f4,...

@mattie-bundle/mattie-strapi-bundle-example (>=1.0.0-alpha.0 <=1.0.0-alpha.3), @nx-extend/strapi (=3.5.2) +6 more potentially affected by CVE-2023-34093 via @strapi/strapi (>=0.0.0-a3ff110fc401ef4fbd6cd90780bf87a83a2cb04b <=4.10.8-exp.0)

@strapi/strapi NPM version =0.0.0-a3ff110fc401ef4fbd6cd90780bf87a83a2cb04b, =1.0.0-alpha.0, =0.0.0-00c0da0e5db43d5de823f6193c9a3fa0dd11a364, =0.0.0-00c0da0e5db43d5de823f6193c9a3fa0dd11a364, =0.0.0-02d487e4eec68a5961817a4f580ffead9a9362f0, =4.10.1-experimental.0 - leimonstrapi2 =4.10.5 -...

GHSA-CHMR-RG2F-9JMF Making all attributes on a content-type public without noticing it

Summary Anyone Strapi developers, users, plugins can make every attribute of a Content-Type public without knowing it. Details When dealing with content-types inside a Strapi instance, we can extend those using the appropriate container: javascript...

Making all attributes on a content-type public without noticing it

Summary Anyone Strapi developers, users, plugins can make every attribute of a Content-Type public without knowing it. Details When dealing with content-types inside a Strapi instance, we can extend those using the appropriate container: javascript...

CVE-2023-34093

Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone Strapi developers, users, plugins can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types by Strapi, not the actual content types...

Design/Logic Flaw

Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone Strapi developers, users, plugins can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types by Strapi, not the actual content types...

CVE-2023-34093 Strapi allows actors to make all attributes on a content-type public without noticing it

Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone Strapi developers, users, plugins can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types by Strapi, not the actual content types...

CVE-2023-34093 Strapi allows actors to make all attributes on a content-type public without noticing it

Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone Strapi developers, users, plugins can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types by Strapi, not the actual content types...

CVE-2023-34093 Strapi allows actors to make all attributes on a content-type public without noticing it

Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone Strapi developers, users, plugins can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types by Strapi, not the actual content types...

CVE-2023-34093

Strapi (open-source CMS) prior to version 4.10.8 is vulnerable to information disclosure due to improper handling of Content-Type attributes. The issue arises from the removal of the privateAttributes getter when users extend or modify content-types, which can cause any attribute to become public...

CVE-2023-34235

creationtimestamp| type| source ---|---|--- 2023-07-25 13:10:12+00:00| published-proof-of-concept| https://github.com/strapi/strapi/security/advisories/GHSA-9xg4-3qfm-9w8f...

Strapi 信息泄露漏洞

Strapi is an open source content management system CMS. An information disclosure vulnerability exists in Strapi versions prior to 4.10.8, which stems from a Knex query that allows a user to change the default prefix, which may disclose private fields if the tnumber prefix is used...