@antgineering-studio/strapi (4.5.5), @chargeover/strapi (0.0.1-rc1.1) +43 more potentially affected by CVE-2023-34235 via @strapi/database (>=4.0.0, <=4.10.7)

@strapi/database NPM version =4.0.0, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.9.2, =4.9.2, =1.0.5, =2.0.13 and more Source cves: CVE-2023-34235 Source advisory: OSV:GHSA-9XG4-3QFM-9W8F...

@antgineering-studio/strapi (4.5.5), @chargeover/strapi (0.0.1-rc1.1) +100 more potentially affected by CVE-2023-34093 via @strapi/utils (>=4.0.0, <=4.10.7)

@strapi/utils NPM version =4.0.0, =1.0.0, =1.3.0, =1.4.1 - @codeparticle/strapi-plugin-graphql 4.9.2 and more Source cves: CVE-2023-34093 Source advisory: OSV:GHSA-CHMR-RG2F-9JMF...

@antgineering-studio/strapi (4.5.5), @chargeover/strapi (0.0.1-rc1.1) +43 more potentially affected by CVE-2023-34093 via @strapi/database (>=4.0.0, <=4.10.7)

@strapi/database NPM version =4.0.0, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.9.2, =4.9.2, =1.0.5, =2.0.13 and more Source cves: CVE-2023-34093 Source advisory: OSV:GHSA-CHMR-RG2F-9JMF...

GHSA-CHMR-RG2F-9JMF Making all attributes on a content-type public without noticing it

Summary Anyone Strapi developers, users, plugins can make every attribute of a Content-Type public without knowing it. Details When dealing with content-types inside a Strapi instance, we can extend those using the appropriate container: javascript...

Making all attributes on a content-type public without noticing it

Summary Anyone Strapi developers, users, plugins can make every attribute of a Content-Type public without knowing it. Details When dealing with content-types inside a Strapi instance, we can extend those using the appropriate container: javascript...

@chargeover/strapi (0.0.1-rc1.1), @code-mancers/strapi-plugin-stellate (>=1.0.0, <=1.5.1) +34 more potentially affected by CVE-2023-34093 via @strapi/strapi (>=4.0.0-beta.0, <=4.10.7)

@strapi/strapi NPM version =4.0.0-beta.0, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.9.2, =4.9.2, =1.0.5, =1.0.5, =1.0.0-alpha.0, =1.0.0-alpha.3 - @nexacarts/admin 2.0.9 and more Source cves: CVE-2023-34093 Source advisory: OSV:GHSA-CHMR-RG2F-9JMF...

CVE-2023-34093

Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone Strapi developers, users, plugins can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types by Strapi, not the actual content types...

Design/Logic Flaw

Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone Strapi developers, users, plugins can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types by Strapi, not the actual content types...

CVE-2023-34093 Strapi allows actors to make all attributes on a content-type public without noticing it

Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone Strapi developers, users, plugins can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types by Strapi, not the actual content types...

CVE-2023-34093 Strapi allows actors to make all attributes on a content-type public without noticing it

Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone Strapi developers, users, plugins can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types by Strapi, not the actual content types...

CVE-2023-34093

Strapi (open-source CMS) prior to version 4.10.8 is vulnerable to information disclosure due to improper handling of Content-Type attributes. The issue arises from the removal of the privateAttributes getter when users extend or modify content-types, which can cause any attribute to become public...

CVE-2023-34093 Strapi allows actors to make all attributes on a content-type public without noticing it

Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone Strapi developers, users, plugins can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types by Strapi, not the actual content types...

CVE-2023-34235

creationtimestamp| type| source ---|---|--- 2023-07-25 13:10:12+00:00| published-proof-of-concept| https://github.com/strapi/strapi/security/advisories/GHSA-9xg4-3qfm-9w8f...

PT-2023-24666 · Strapi · Strapi

Name of the Vulnerable Software and Affected Versions: Strapi versions prior to 4.10.8 Description: The issue affects the handling of content types by Strapi, allowing anyone to make every attribute of a Content-Type public without knowing it. This can lead to sensitive information being exposed ...

Strapi 信息泄露漏洞

Strapi is an open source content management system CMS. An information disclosure vulnerability exists in Strapi versions prior to 4.10.8, which stems from a Knex query that allows a user to change the default prefix, which may disclose private fields if the tnumber prefix is used...

Strapi 信息泄露漏洞

Strapi is an open source content management system CMS. An information disclosure vulnerability exists in Strapi versions prior to 4.10.8, which originates from the fact that anyone can unknowingly expose properties of Content-Type, resulting in the exposure of sensitive information or the contro...

PT-2023-24759

Name of the Vulnerable Software and Affected Versions Strapi versions prior to 4.10.8 Description The issue allows for the leakage of private fields when using the tnumber prefix. This is possible because the Knex query allows users to change the default prefix. For example, changing the prefix t...

Authentication Bypass

@strapi/plugin-users-permissions is vulnerable to Authentication Bypass. When using the AWS Cognito login provider for authentication, the library doesn't check access or ID tokens generated throughout the OAuth flow. A remote attacker might impersonate any user using AWS Cognito by fabricating a...

Exploit for Injection in Strapi

CVE-2023-22621-POC CVE-2023-22621: SSTI to RCE by Exploiting E...

Sensitive Information Disclosure

@strapi/strapi is vulnerable to Information Disclosure. An unauthenticated attacker can filter users by columns that contain sensitive information and infer the values by the changes in the API responses, which leads to hijacking Strapi administrator accounts and gaining unauthorized Strapi Super...