npm/@strapi/strapi CVE-2022-31367: high 8.8, EPSS 1.72%
Strapi mishandles hidden attributes within admin API responses
Action: Upgrade @strapi/strapi to 4.1.10 or later.
npm i @strapi/strapi@4.1.10Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0-next.0 | 4.1.10 | - |
Fixed versions
| 4.1.10 |
Sources
- osv: GHSA-4phg-hpqm-c3j4#npm/@strapi/strapi
- https://nvd.nist.gov/vuln/detail/CVE-2022-31367
- https://github.com/strapi/strapi/pull/13185
- https://github.com/strapi/strapi/pull/13189
- https://github.com/kos0ng/CVEs/tree/main/CVE-2022-31367
- https://github.com/strapi/strapi
- https://github.com/strapi/strapi/releases/tag/v3.6.10
- https://github.com/strapi/strapi/releases/tag/v4.1.10
CVE-2022-31367 · published · modified · JSON