Homepage

@strapi/utils@4.1.8 vulnerabilities

Shared utilities for the Strapi packages

  • latest version

    5.6.0

  • latest non vulnerable version

    5.7.0-beta.0

  • first published

    3 years ago

  • latest version published

    9 days ago

  • licenses detected

  • View utils package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @strapi/utils package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Information Exposure

    @strapi/utils is a Shared utilities for the Strapi packages

    Affected versions of this package are vulnerable to Information Exposure such that attackers can get access to user reset password tokens given that they have the configure view permissions. This issue arises because the /content-manager/relations route does not remove private fields or ensure that they can't be selected.

    How to fix Information Exposure?

    Upgrade @strapi/utils to version 4.11.7 or higher.

    <4.11.7
    • H
    Information Exposure

    @strapi/utils is a Shared utilities for the Strapi packages

    Affected versions of this package are vulnerable to Information Exposure such that it is possible to leak private fields if one is using the t(number) prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to another table they want to query, the query changes from password to t1.password. password is protected by filtering protections but t1.password is not protected.

    Note:

    This can lead to filtering attacks on everything related to the object, including admin passwords and reset-tokens.

    How to fix Information Exposure?

    Upgrade @strapi/utils to version 4.10.8 or higher.

    <4.10.8
    • M
    Information Exposure

    @strapi/utils is a Shared utilities for the Strapi packages

    Affected versions of this package are vulnerable to Information Exposure by developers, users, or plugins, all of who can make every attribute of a Content-Type public without knowing it. The privateAttributes getter is removed when content types are modified, which can result in any attribute becoming public.

    NOTE: If a user mutates the content-type they will not be affected.

    How to fix Information Exposure?

    Upgrade @strapi/utils to version 4.10.8 or higher.

    <4.10.8
    Go back to all versions of this package