{"url":"http://public2.vulnerablecode.io/api/packages/61970?format=json","purl":"pkg:npm/%40strapi/strapi@4.0.0","type":"npm","namespace":"@strapi","name":"strapi","version":"4.0.0","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"4.1.5","latest_non_vulnerable_version":"5.37.0","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/46333?format=json","vulnerability_id":"VCID-jpqv-dukr-fyhu","summary":"Unauthorized Access to Private Fields in User Registration API\n### System Details\n| Name   | Value         |\n|----------|------------------------|\n| OS    | Windows 11       |\n| Version | 4.11.1 (node v16.14.2) |\n| Database | mysql         |\n\n\n### Description\nI marked some fields as private fields in user content-type, and tried to register as a new user via api, at the same time I added content to fill the private fields and sent a post request, and as you can see from the images below, I can write to the private fields. To prevent this, I went to the extension area and tried to extend the register method, for this I wanted to do it using the sanitizeInput function that I know in the source codes of the strap. But the sanitizeInput function does not filter out private fields.\n\n```js\n const { auth } = ctx.state;\n const data = ctx.request.body;\n const userSchema = strapi.getModel(\"plugin::users-permissions.user\");\n\n sanitize.contentAPI.input(data, userSchema, { auth });\n```\n\nhere's the solution I've temporarily kept to myself, code snippet\n\n```js\n const body = ctx.request.body;\n\n const { attributes } = strapi.getModel(\"plugin::users-permissions.user\");\n\n const sanitizedData = _.omitBy(body, (data, key) => {\n  const attribute = attributes[key];\n\n  if (_.isNil(attribute)) {\n   return false;\n  }\n\n  //? If you want, you can throw an error for fields that we does not expect.\n\n  // if (_.isNil(attribute))\n  //  throw new ApplicationError(`Unexpected value ${key}`);\n\n  // if private value is true, we do not want to send it to the database.\n  return attribute.private;\n });\n\n return sanitizedData;\n```","references":[{"reference_url":"https://github.com/strapi/strapi","reference_id":"","reference_type":"","scores":[{"value":"7.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/strapi/strapi"},{"reference_url":"https://strapi.io/blog/security-disclosure-of-vulnerabilities-sept-2023","reference_id":"","reference_type":"","scores":[{"value":"7.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://strapi.io/blog/security-disclosure-of-vulnerabilities-sept-2023"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39345","reference_id":"CVE-2023-39345","reference_type":"","scores":[{"value":"7.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39345"},{"reference_url":"https://github.com/advisories/GHSA-gc7p-j5xm-xxh2","reference_id":"GHSA-gc7p-j5xm-xxh2","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-gc7p-j5xm-xxh2"},{"reference_url":"https://github.com/strapi/strapi/security/advisories/GHSA-gc7p-j5xm-xxh2","reference_id":"GHSA-gc7p-j5xm-xxh2","reference_type":"","scores":[{"value":"7.6","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/strapi/strapi/security/advisories/GHSA-gc7p-j5xm-xxh2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/67608?format=json","purl":"pkg:npm/%40strapi/strapi@4.13.1","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/%2540strapi/strapi@4.13.1"}],"aliases":["CVE-2023-39345","GHSA-gc7p-j5xm-xxh2"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-jpqv-dukr-fyhu"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/43244?format=json","vulnerability_id":"VCID-qcu6-ntuc-byea","summary":"Insecure Storage of Sensitive Information\nStoring passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi allows an attacker to access a victim's HTTP request, get the victim's cookie, perform a base64 decode on the victim's cookie, and obtain a cleartext password, leading to getting API documentation for further API attacks.","references":[{"reference_url":"http://packetstormsecurity.com/files/166915/Strapi-3.6.8-Password-Disclosure-Insecure-Handling.html","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://packetstormsecurity.com/files/166915/Strapi-3.6.8-Password-Disclosure-Insecure-Handling.html"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2021-46440","reference_id":"","reference_type":"","scores":[{"value":"0.03089","scoring_system":"epss","scoring_elements":"0.87027","published_at":"2026-06-04T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-46440"},{"reference_url":"https://github.com/strapi/strapi","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/strapi/strapi"},{"reference_url":"https://github.com/strapi/strapi/pull/12246","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/strapi/strapi/pull/12246"},{"reference_url":"https://hub.docker.com/r/strapi/strapi","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://hub.docker.com/r/strapi/strapi"},{"reference_url":"https://strapi.io","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://strapi.io"},{"reference_url":"https://strapi.io/","reference_id":"","reference_type":"","scores":[],"url":"https://strapi.io/"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46440","reference_id":"CVE-2021-46440","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46440"},{"reference_url":"https://github.com/advisories/GHSA-85vg-grr5-pw42","reference_id":"GHSA-85vg-grr5-pw42","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-85vg-grr5-pw42"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/61971?format=json","purl":"pkg:npm/%40strapi/strapi@4.1.5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/%2540strapi/strapi@4.1.5"}],"aliases":["CVE-2021-46440","GHSA-85vg-grr5-pw42"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-qcu6-ntuc-byea"}],"fixing_vulnerabilities":[],"risk_score":"4.0","resource_url":"http://public2.vulnerablecode.io/packages/pkg:npm/%2540strapi/strapi@4.0.0"}