@antgineering-studio/strapi (4.5.5), @chargeover/strapi (0.0.1-rc1.1) +43 more potentially affected by CVE-2023-34093 via @strapi/database (>=4.0.0, <=4.10.7)

@strapi/database NPM version =4.0.0, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.2, =4.9.2, =4.9.2, =1.0.5, =2.0.13 and more Source cves: CVE-2023-34093 Source advisory: OSV:GHSA-CHMR-RG2F-9JMF...

@antgineering-studio/strapi (4.5.5), @chargeover/strapi (0.0.1-rc1.1) +100 more potentially affected by CVE-2023-34093 via @strapi/utils (>=4.0.0, <=4.10.7)

@strapi/utils NPM version =4.0.0, =1.0.0, =1.3.0, =1.4.1 - @codeparticle/strapi-plugin-graphql 4.9.2 and more Source cves: CVE-2023-34093 Source advisory: OSV:GHSA-CHMR-RG2F-9JMF...

@chargeover/strapi (0.0.1-rc1.1), @code-mancers/strapi-plugin-stellate (>=1.0.0, <=1.5.1) +34 more potentially affected by CVE-2023-34093 via @strapi/strapi (>=4.0.0-beta.0, <=4.10.7)

@strapi/strapi NPM version =4.0.0-beta.0, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.9.2, =4.9.2, =1.0.5, =1.0.5, =1.0.0-alpha.0, =1.0.0-alpha.3 - @nexacarts/admin 2.0.9 and more Source cves: CVE-2023-34093 Source advisory: OSV:GHSA-CHMR-RG2F-9JMF...

CVE-2023-34093

Strapi (open-source CMS) prior to version 4.10.8 is vulnerable to information disclosure due to improper handling of Content-Type attributes. The issue arises from the removal of the privateAttributes getter when users extend or modify content-types, which can cause any attribute to become public...

CVE-2023-34093

creationtimestamp| type| source ---|---|--- 2023-07-25 13:10:08+00:00| published-proof-of-concept| https://github.com/strapi/strapi/security/advisories/GHSA-chmr-rg2f-9jmf 2023-07-25 18:26:56+00:00| seen| https://t.me/cibsecurity/67241...