CVE-2023-30843: Exposure of Sensitive Information to an Unauthorized Actor

April 26, 2023 (updated May 5, 2023)

Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Version 1.7.0 contains a patch. As a workaround, write a beforeOperation hook to remove where queries that attempt to access hidden field data.

References

github.com/advisories/GHSA-35jj-vqcf-f2jf
github.com/payloadcms/payload/releases/tag/v1.7.0
github.com/payloadcms/payload/security/advisories/GHSA-35jj-vqcf-f2jf
nvd.nist.gov/vuln/detail/CVE-2023-30843

Code Behaviors & Features

Detect and mitigate CVE-2023-30843 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →