Skip to content
OpenAdvisories

Package · npm

@strapi/utils

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 5.8
    CVE-2023-36472

    Strapi may leak sensitive user information, user reset password, tokens via content-manager views

    Strapi is an open-source headless content management system. Prior to version 4.11.7, an unauthorized actor can get access to user reset password tokens if they have the configure view permissions. The `/content-manager/relations` route does not remove privat…

    strapi strapi @strapi/admin @strapi/plugin-content-manager npm
  • High 8.6
    CVE-2023-34235

    Leaking sensitive user information still possible by filtering on private with prefix fields

    Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the `t(number)` prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefi…

    strapi strapi @strapi/utils @strapi/database npm
  • Medium 4.8
    CVE-2023-34093

    Strapi allows actors to make all attributes on a content-type public without noticing it

    Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone (Strapi developers, users, plugins) can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types…

    strapi strapi @strapi/strapi @strapi/utils npm