{"action":"Upgrade @strapi/database to 4.10.8 or later.","affected":[{"fixed":"4.10.8","introduced":"0"}],"component":"@strapi/database","cve_ids":["CVE-2023-34235"],"ecosystem":"npm","epss":0.01095,"exploited":false,"fixed_versions":["4.10.8"],"ghsa_id":"GHSA-9xg4-3qfm-9w8f","id":"tcs_01M5KFHADS9DQRJWQ0QKBA3TSV","modified_at":"2023-11-08T04:12:45.156522Z","published_at":"2023-07-25T17:17:37Z","references":["https://osv.dev/vulnerability/GHSA-9xg4-3qfm-9w8f","https://github.com/strapi/strapi/security/advisories/GHSA-9xg4-3qfm-9w8f","https://nvd.nist.gov/vuln/detail/CVE-2023-34235","https://github.com/strapi/strapi","https://github.com/strapi/strapi/releases/tag/v4.10.8"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-9xg4-3qfm-9w8f","url":"https://osv.dev/vulnerability/GHSA-9xg4-3qfm-9w8f"}],"summary":"Leaking sensitive user information still possible by filtering on private with prefix fields"}