AIKIDO-2024-10484
@strapi/plugin-graphql is vulnerable to Private Data Structure Returned From A Public Method
32
CVE Score
Low
Private Data Structure Returned From A Public Method
TL;DR
Affected versions of this package expose attributes tagged as private within the GraphQL input and filter schema definitions. This vulnerability can lead to unintended data exposure, allowing clients to query or filter sensitive fields that should remain hidden. As a result, attackers or unauthorized users may gain access to confidential information, potentially compromising the security and privacy of the application’s data.
How do I fix this?
Upgrade the @strapi/plugin-graphql library to the patch version.
Who does this affect?
You are affected if you are using a version which is within vulnerability ranges
Package
Versions
4.0.0 - 5.4.1
Fixed in 5.4.2Background info
@strapi/plugin-graphql is vulnerable to Private Data Structure Returned From A Public Method in versions 4.0.0 - 5.4.1.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.