CVE-2023-30843
Payload's hidden fields can be leaked on readable collections
Summary
Payload's hidden fields can be leaked on readable collections
Original description
The description as published by the source.
Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Version 1.7.0 contains a patch. As a workaround, write a beforeOperation hook to remove where queries that attempt to access hidden field data.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
npm
payload
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.0"}]}]
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web github.com