Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/61970?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/61970?format=api", "purl": "pkg:npm/%40strapi/strapi@4.0.0", "type": "npm", "namespace": "@strapi", "name": "strapi", "version": "4.0.0", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "4.1.5", "latest_non_vulnerable_version": "5.37.0", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/46333?format=api", "vulnerability_id": "VCID-jpqv-dukr-fyhu", "summary": "Unauthorized Access to Private Fields in User Registration API\n### System Details\n| Name | Value |\n|----------|------------------------|\n| OS | Windows 11 |\n| Version | 4.11.1 (node v16.14.2) |\n| Database | mysql |\n\n\n### Description\nI marked some fields as private fields in user content-type, and tried to register as a new user via api, at the same time I added content to fill the private fields and sent a post request, and as you can see from the images below, I can write to the private fields. To prevent this, I went to the extension area and tried to extend the register method, for this I wanted to do it using the sanitizeInput function that I know in the source codes of the strap. But the sanitizeInput function does not filter out private fields.\n\n```js\n const { auth } = ctx.state;\n const data = ctx.request.body;\n const userSchema = strapi.getModel(\"plugin::users-permissions.user\");\n\n sanitize.contentAPI.input(data, userSchema, { auth });\n```\n\nhere's the solution I've temporarily kept to myself, code snippet\n\n```js\n const body = ctx.request.body;\n\n const { attributes } = strapi.getModel(\"plugin::users-permissions.user\");\n\n const sanitizedData = _.omitBy(body, (data, key) => {\n const attribute = attributes[key];\n\n if (_.isNil(attribute)) {\n return false;\n }\n\n //? If you want, you can throw an error for fields that we does not expect.\n\n // if (_.isNil(attribute))\n // throw new ApplicationError(`Unexpected value ${key}`);\n\n // if private value is true, we do not want to send it to the database.\n return attribute.private;\n });\n\n return sanitizedData;\n```", "references": [ { "reference_url": "https://github.com/strapi/strapi", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/strapi/strapi" }, { "reference_url": "https://strapi.io/blog/security-disclosure-of-vulnerabilities-sept-2023", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://strapi.io/blog/security-disclosure-of-vulnerabilities-sept-2023" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39345", "reference_id": "CVE-2023-39345", "reference_type": "", "scores": [ { "value": "7.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39345" }, { "reference_url": "https://github.com/advisories/GHSA-gc7p-j5xm-xxh2", "reference_id": "GHSA-gc7p-j5xm-xxh2", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-gc7p-j5xm-xxh2" }, { "reference_url": "https://github.com/strapi/strapi/security/advisories/GHSA-gc7p-j5xm-xxh2", "reference_id": "GHSA-gc7p-j5xm-xxh2", "reference_type": "", "scores": [ { "value": "7.6", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/strapi/strapi/security/advisories/GHSA-gc7p-j5xm-xxh2" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/67608?format=api", "purl": "pkg:npm/%40strapi/strapi@4.13.1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/%2540strapi/strapi@4.13.1" } ], "aliases": [ "CVE-2023-39345", "GHSA-gc7p-j5xm-xxh2" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-jpqv-dukr-fyhu" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/43244?format=api", "vulnerability_id": "VCID-qcu6-ntuc-byea", "summary": "Insecure Storage of Sensitive Information\nStoring passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi allows an attacker to access a victim's HTTP request, get the victim's cookie, perform a base64 decode on the victim's cookie, and obtain a cleartext password, leading to getting API documentation for further API attacks.", "references": [ { "reference_url": "http://packetstormsecurity.com/files/166915/Strapi-3.6.8-Password-Disclosure-Insecure-Handling.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://packetstormsecurity.com/files/166915/Strapi-3.6.8-Password-Disclosure-Insecure-Handling.html" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-46440", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.03089", "scoring_system": "epss", "scoring_elements": "0.87027", "published_at": "2026-06-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-46440" }, { "reference_url": "https://github.com/strapi/strapi", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/strapi/strapi" }, { "reference_url": "https://github.com/strapi/strapi/pull/12246", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/strapi/strapi/pull/12246" }, { "reference_url": "https://hub.docker.com/r/strapi/strapi", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://hub.docker.com/r/strapi/strapi" }, { "reference_url": "https://strapi.io", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://strapi.io" }, { "reference_url": "https://strapi.io/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://strapi.io/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46440", "reference_id": "CVE-2021-46440", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46440" }, { "reference_url": "https://github.com/advisories/GHSA-85vg-grr5-pw42", "reference_id": "GHSA-85vg-grr5-pw42", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-85vg-grr5-pw42" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/61971?format=api", "purl": "pkg:npm/%40strapi/strapi@4.1.5", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/%2540strapi/strapi@4.1.5" } ], "aliases": [ "CVE-2021-46440", "GHSA-85vg-grr5-pw42" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-qcu6-ntuc-byea" } ], "fixing_vulnerabilities": [], "risk_score": "4.0", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/%2540strapi/strapi@4.0.0" }