CVE-2023-22894-PoC

Este repositorio no tiene un README...

@chargeover/strapi (0.0.1-rc1.1), @digicms/admin (>=1.0.5, <=1.1.0) +16 more potentially affected by CVE-2023-22894 via @strapi/strapi (>=4.0.0-beta.0, <=4.7.2-exp.175f7ac70ee76d6c825e4429e15fc85ee78d23bb)

@strapi/strapi NPM version =4.0.0-beta.0, =1.0.5, =1.0.5, =1.0.0-alpha.0, =3.1.2, =1.0.0, =4.6.0-beta.2, =0.0.0, =4.7.2-exp.175f7ac70ee76d6c825e4429e15fc85ee78d23bb, =0.0.84, =0.0.0, =0.9.0, =0.9.2 and more Source cves: CVE-2023-22894 Source advisory: OSV:GHSA-JJQF-J4W7-92W8...

Strapi leaking sensitive user information by filtering on private fields

Summary Strapi through 4.7.1 allows unauthenticated attackers to discover sensitive user details for Strapi administrators and API users. Details Strapi through 4.7.1 allows unauthenticated attackers to discover sensitive user details for Strapi administrators and API users. The unauthenticated...

GHSA-JJQF-J4W7-92W8 Strapi leaking sensitive user information by filtering on private fields

Summary Strapi through 4.7.1 allows unauthenticated attackers to discover sensitive user details for Strapi administrators and API users. Details Strapi through 4.7.1 allows unauthenticated attackers to discover sensitive user details for Strapi administrators and API users. The unauthenticated...

CVE-2023-22894

Strapi through 4.5.5 allows attackers with access to the admin panel to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then th...

CVE-2023-22894

Strapi versions through 4.7.1 (and specifically through 4.5.5 in some contexts) are vulnerable to an information disclosure flaw. An unauthenticated attacker can manipulate public collection query filters to target private fields , allowing them to infer sensitive information such as password has...