Strapi mishandles hidden attributes within admin API responses

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2022-31367 · ADVISORY
• strapi/strapi#13185 · WEB
• strapi/strapi#13189 · WEB
• kos0ng/CVEs · WEB
• strapi/strapi · PACKAGE
• strapi/strapi release v3.6.10 · WEB
• strapi/strapi release v4.1.10 · WEB

Lỗ hổng khác của strapi

• CVE-2026-57997TRUNG BÌNH 5.4Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.algorithm is not explicitly configured, …
• CVE-2026-27886CAO 7.5Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did not sufficiently sani…
• CVE-2026-22707TRUNG BÌNH 5.4Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, the Upload plugin's Content API endpoints d…
• CVE-2026-22706TRUNG BÌNH 6.5Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did…
• CVE-2026-22599CAO 7.2Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.…