CVE-2023-30843
Payload's hidden fields can be leaked on readable collections
概要
Payload's hidden fields can be leaked on readable collections
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Version 1.7.0 contains a patch. As a workaround, write a beforeOperation hook to remove where queries that attempt to access hidden field data.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
npm
payload
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.0"}]}]
参照URL
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web github.com