npm/strapi CVE-2022-31367: high 8.8, EPSS 1.72%

Strapi mishandles hidden attributes within admin API responses

Action: Upgrade strapi to 3.6.10 or later.

npm i strapi@3.6.10

Affected

Fixed versions

Sources

• osv: GHSA-4phg-hpqm-c3j4
• https://nvd.nist.gov/vuln/detail/CVE-2022-31367
• https://github.com/strapi/strapi/pull/13185
• https://github.com/strapi/strapi/pull/13189
• https://github.com/kos0ng/CVEs/tree/main/CVE-2022-31367
• https://github.com/strapi/strapi
• https://github.com/strapi/strapi/releases/tag/v3.6.10
• https://github.com/strapi/strapi/releases/tag/v4.1.10

CVE-2022-31367 · published 2022-09-28T00:00:17Z · modified 2023-11-08T04:09:30.540882Z · JSON