PT-2022-20719 · Strapi · Strapi

Achmad Zaenuri Dahlan Putra + 1 · Published 2022-09-27 · Updated 2022-09-30 · CVE-2022-31367

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Strapi versions 3.x through 3.6.9 Strapi versions 4.x through 4.1.9

Description The issue concerns the mishandling of hidden attributes within admin API responses.

Recommendations For Strapi versions 3.x through 3.6.9, update to version 3.6.10 or later. For Strapi versions 4.x through 4.1.9, update to version 4.1.10 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-31367

GHSA-4PHG-HPQM-C3J4

Affected Products

Strapi

References · 10

• 🔥 https://github.com/kos0ng/CVEs/tree/main/CVE-2022-31367 · Exploit
• https://osv.dev/vulnerability/CVE-2022-31367 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31367 · Security Note
• https://osv.dev/vulnerability/GHSA-4phg-hpqm-c3j4 · Vendor Advisory
• https://github.com/strapi/strapi · Note
• https://github.com/strapi/strapi/releases/tag/v4.1.10 · Note
• https://github.com/strapi/strapi/pull/13189 · Note
• https://github.com/strapi/strapi/releases/tag/v3.6.10 · Note
• https://github.com/strapi/strapi/pull/13185 · Note
• https://t.me/cibsecurity/50549 · Telegram Post