GHSA-4phg-hpqm-c3j4
Strapi mishandles hidden attributes within admin API responses
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | strapi | < 3.6.10 | 3.6.10 |
| npm | @strapi/strapi | >= 4.0.0-next.0, < 4.1.10 | 4.1.10 |
Details
As written in the advisory (Markdown source, shown as plain text).
Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2022-31367
- https://github.com/strapi/strapi/pull/13185
- https://github.com/strapi/strapi/pull/13189
- https://github.com/kos0ng/CVEs/tree/main/CVE-2022-31367
- https://github.com/strapi/strapi
- https://github.com/strapi/strapi/releases/tag/v3.6.10
- https://github.com/strapi/strapi/releases/tag/v4.1.10