Homepage

payload@3.42.0-internal.dfe4bec

Node, React, Headless CMS and Application Framework built on Next.js

  • latest version

    3.81.0

  • latest non vulnerable version

    3.82.0-canary.1

  • first published

    11 years ago

  • latest version published

    1 days ago

  • licenses detected

  • View payload package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the payload package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Server-side Request Forgery (SSRF)

    payload is a Node, React and MongoDB Headless CMS and Application Framework

    Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the upload endpoint. An attacker can cause the server to initiate unauthorized outbound HTTP requests to arbitrary URLs by submitting crafted data as an authenticated user with create or update access to an upload-enabled collection.

    How to fix Server-side Request Forgery (SSRF)?

    Upgrade payload to version 3.79.1 or higher.

    <3.79.1
    • H
    Directory Traversal

    payload is a Node, React and MongoDB Headless CMS and Application Framework

    Affected versions of this package are vulnerable to Directory Traversal via insufficient sanitization of filenames in the client-upload signed-URL endpoints for S3, GCS, Azure, and R2. An attacker can escape the intended storage location by submitting specially crafted filenames.

    How to fix Directory Traversal?

    Upgrade payload to version 3.78.0 or higher.

    <3.78.0
    • M
    Cross-site Request Forgery (CSRF)

    payload is a Node, React and MongoDB Headless CMS and Application Framework

    Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via the authentication flow when serverURL is configured. An attacker can perform unauthorized actions on behalf of authenticated users by tricking them into visiting a malicious site that issues cross-site requests.

    How to fix Cross-site Request Forgery (CSRF)?

    Upgrade payload to version 3.79.1 or higher.

    <3.79.1
    • M
    SQL Injection

    payload is a Node, React and MongoDB Headless CMS and Application Framework

    Affected versions of this package are vulnerable to SQL Injection via the endpoints accepting dynamic query for Collections. An attacker can access sensitive information or modify data by submitting specially crafted inputs that manipulate SQL query execution.

    How to fix SQL Injection?

    Upgrade payload to version 3.79.1 or higher.

    <3.79.1
    • C
    Weak Password Recovery Mechanism for Forgotten Password

    payload is a Node, React and MongoDB Headless CMS and Application Framework

    Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Password in the password recovery flow. An attacker can gain unauthorized access to user accounts by exploiting insufficient input validation of the origin of the password reset request.

    How to fix Weak Password Recovery Mechanism for Forgotten Password?

    Upgrade payload to version 3.79.1 or higher.

    <3.79.1
    • H
    Server-side Request Forgery (SSRF)

    payload is a Node, React and MongoDB Headless CMS and Application Framework

    Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the external file upload endpoint due to insufficient validation of HTTP redirects. An attacker can access internal network resources and retrieve response content from internal services by submitting crafted external URLs for file uploads.

    Note:

    This is only exploitable if at least one collection has upload enabled and the attacker has create access to that upload-enabled collection.

    How to fix Server-side Request Forgery (SSRF)?

    Upgrade payload to version 3.75.0 or higher.

    <3.75.0
    • L
    Authorization Bypass Through User-Controlled Key

    payload is a Node, React and MongoDB Headless CMS and Application Framework

    Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the auth collections in multi-auth collection environments using Postgres or SQLite with serial or auto-increment IDs. An attacker can access and delete preferences belonging to users in different authentication collections by exploiting numeric ID collisions.

    How to fix Authorization Bypass Through User-Controlled Key?

    Upgrade payload to version 3.74.0 or higher.

    <3.74.0
    • M
    Insufficient Session Expiration

    payload is a Node, React and MongoDB Headless CMS and Application Framework

    Affected versions of this package are vulnerable to Insufficient Session Expiration due to the failure to invalidate JSON Web Tokens after user log out. An attacker can maintain unauthorised access by reusing a stolen or intercepted token until its expiration date.

    How to fix Insufficient Session Expiration?

    Upgrade payload to version 3.44.0 or higher.

    <3.44.0
    • M
    Insufficient Session Expiration

    payload is a Node, React and MongoDB Headless CMS and Application Framework

    Affected versions of this package are vulnerable to Insufficient Session Expiration due to the reuse of user identifiers in the account creation process. An attacker can gain unauthorised access to a newly created user account by reusing a previously saved JSON Web Token (JWT) after deleting the original account.

    How to fix Insufficient Session Expiration?

    Upgrade payload to version 3.44.0 or higher.

    <3.44.0
    Go back to all versions of this package