{"id":"CVE-2022-31367","published":"2022-09-27T13:02:41Z","modified":"2025-05-22T13:50:07Z","title":"Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses","vendor":null,"product":null,"tier":"tail","description":{"text":"Strapi before 3.6.10 and 4.x before 4.1.10 mishandles hidden attributes within admin API responses.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.0172,"percentile":0.77381,"provenance":"source"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://github.com/strapi/strapi/releases/tag/v4.1.10","tags":["x_refsource_MISC"]},{"url":"https://github.com/strapi/strapi/releases/tag/v3.6.10","tags":["x_refsource_MISC"]},{"url":"https://github.com/kos0ng/CVEs/tree/main/CVE-2022-31367","tags":["x_refsource_MISC"]}],"priority":{"score":21.6,"factors":[{"name":"EPSS percentile","points":15.48},{"name":"CVSS severity","points":6.16}]},"affected":[{"ecosystem":"npm","package":"strapi","vulnerableRanges":["<3.6.10"],"patched":["3.6.10"],"from":["GHSA-4phg-hpqm-c3j4"],"provenance":"source"},{"ecosystem":"npm","package":"@strapi/strapi","vulnerableRanges":[">=4.0.0-next.0, <4.1.10"],"patched":["4.1.10"],"from":["GHSA-4phg-hpqm-c3j4"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-6691","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2021-46440","published":"2022-05-03","fixed":"3.6.9","kev":false},{"cve":"CVE-2022-30617","published":"2022-05-19","fixed":"3.6.9","kev":false},{"cve":"CVE-2022-30618","published":"2022-05-19","fixed":"3.6.9","kev":false,"link":{"from":"CVE-2022-30618","to":"CVE-2022-31367","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:strapi","fromFixed":"3.6.9","toFixed":"3.6.10","daysApart":131},{"kind":"version-step","provenance":"source","package":"npm:@strapi/strapi","fromFixed":"4.1.9","toFixed":"4.1.10","daysApart":131}]}},{"cve":"CVE-2022-31367","published":"2022-09-27","fixed":"3.6.10","kev":false},{"cve":"CVE-2022-0764","published":"2022-02-26","fixed":"4.1.0","kev":false}],"package":"npm:strapi"}}