CVE-2023-34235
Description
Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the `t(number)` prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to another table they want to query, the query changes from `password` to `t1.password`. `password` is protected by filtering protections but `t1.password` is not protected. This can lead to filtering attacks on everything related to the object again, including admin passwords and reset-tokens. Version 4.10.8 fixes this issue.
How to fix
- strapi strapi4.10.8 or later
- @strapi/database4.10.8 or later
- @strapi/utils4.10.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| strapi strapi | v < 4.10.8 | 4.10.8 |
| @strapi/databasenpm | v < 4.10.8 | 4.10.8 |
| @strapi/utilsnpm | v < 4.10.8 | 4.10.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.