Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Strapi: Hidden Data Exposed in Admin API Responses

CVE-2022-31367 · published 4 years ago
Summary

Strapi versions before 3.6.10 and 4.x before 4.1.10 may leak sensitive information in their admin API responses. This could allow unauthorized users to access data that is intended to be private. To fix this, upgrade to the latest version of Strapi.

What to do
  • Update alexandrebodin strapi to version 3.6.10.
  • Update strapi strapi to version 4.1.10.
Affected software
Ecosystem VendorProductAffected versions
npm alexandrebodin strapi < 3.6.10
Fix: upgrade to 3.6.10
npm strapi strapi >= 4.0.0-next.0, < 4.1.10
Fix: upgrade to 4.1.10
– strapi strapi < 3.6.10
>= 4.0.0, < 4.1.10
cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*
Original advisory text
Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses.
Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
2% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published27 Sep 2022
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-4phg-hpqm-c3j4 · GHSA
CVE-2022-31367 · NVD
CVE-2022-31367 · OSV
Track software like this
Free during beta