GitHub Advisoryadvisory · npm

GHSA-35jj-vqcf-f2jf Hidden fields can be leaked on readable collections in Payload

HIGH Published 2023-04-26 Modified 2023-04-26 Official page ↗
Aliases
CVE-2023-30843
Ecosystem
npm
Packages
payload
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-200
Reviewed
2023-04-26

Affected packages

• npm payload: < 1.7.0 → fixed in 1.7.0

Description

Details If a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Affected versions: < 1.7.0 Workarounds If you are unable to update, you can write a `beforeOperation` hook to remove `where` queries that attempt to access hidden field data. Detecting Compromise Monitor your instance for brute-force style requests against your instance using `where` queries.

Related

Alias · CVE (1)

  • CVE-2023-30843 Payload is a free and open source headless content management system. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References