CVE-2023-30843 - Vulnerability Details - OpenCVE

Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Version 1.7.0 contains a patch. As a workaround, write a `beforeOperation` hook to remove `where` queries that attempt to access hidden field data.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00227.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Payloadcms	Payload

Configuration 1 [-]

cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-1168	Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Version 1.7.0 contains a patch. As a workaround, write a `beforeOperation` hook to remove `where` queries that attempt to access hidden field data.
Github GHSA	GHSA-35jj-vqcf-f2jf	Hidden fields can be leaked on readable collections in Payload

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/payloadcms/payload/releases/tag/v1.7.0
https://github.com/payloadcms/payload/security/advisories/GHSA-35jj-vqcf-f2jf

History

Mon, 03 Feb 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-04-26T20:32:54.545Z

Updated: 2025-02-03T16:45:55.233Z

Reserved: 2023-04-18T16:13:15.880Z

Link: CVE-2023-30843

Vulnrichment

Updated: 2024-08-02T14:37:15.432Z

NVD

Status : Modified

Published: 2023-04-26T21:15:09.177

Modified: 2024-11-21T08:00:57.300

Link: CVE-2023-30843

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-30843", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-04-18T16:13:15.880Z", "datePublished": "2023-04-26T20:32:54.545Z", "dateUpdated": "2025-02-03T16:45:55.233Z"}, "containers": {"cna": {"title": "Payload's hidden fields can be leaked on readable collections", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/payloadcms/payload/security/advisories/GHSA-35jj-vqcf-f2jf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/payloadcms/payload/security/advisories/GHSA-35jj-vqcf-f2jf"}, {"name": "https://github.com/payloadcms/payload/releases/tag/v1.7.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/payloadcms/payload/releases/tag/v1.7.0"}], "affected": [{"vendor": "payloadcms", "product": "payload", "versions": [{"version": "< 1.7.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-04-26T20:32:54.545Z"}, "descriptions": [{"lang": "en", "value": "Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Version 1.7.0 contains a patch. As a workaround, write a `beforeOperation` hook to remove `where` queries that attempt to access hidden field data."}], "source": {"advisory": "GHSA-35jj-vqcf-f2jf", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T14:37:15.432Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/payloadcms/payload/security/advisories/GHSA-35jj-vqcf-f2jf", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/payloadcms/payload/security/advisories/GHSA-35jj-vqcf-f2jf"}, {"name": "https://github.com/payloadcms/payload/releases/tag/v1.7.0", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/payloadcms/payload/releases/tag/v1.7.0"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-03T16:45:52.366862Z", "id": "CVE-2023-30843", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-03T16:45:55.233Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-30843", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-04-18T16:13:15.880Z", "datePublished": "2023-04-26T20:32:54.545Z", "dateUpdated": "2025-02-03T16:45:55.233Z"}, "containers": {"cna": {"title": "Payload's hidden fields can be leaked on readable collections", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/payloadcms/payload/security/advisories/GHSA-35jj-vqcf-f2jf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/payloadcms/payload/security/advisories/GHSA-35jj-vqcf-f2jf"}, {"name": "https://github.com/payloadcms/payload/releases/tag/v1.7.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/payloadcms/payload/releases/tag/v1.7.0"}], "affected": [{"vendor": "payloadcms", "product": "payload", "versions": [{"version": "< 1.7.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-04-26T20:32:54.545Z"}, "descriptions": [{"lang": "en", "value": "Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Version 1.7.0 contains a patch. As a workaround, write a `beforeOperation` hook to remove `where` queries that attempt to access hidden field data."}], "source": {"advisory": "GHSA-35jj-vqcf-f2jf", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T14:37:15.432Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/payloadcms/payload/security/advisories/GHSA-35jj-vqcf-f2jf", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/payloadcms/payload/security/advisories/GHSA-35jj-vqcf-f2jf"}, {"name": "https://github.com/payloadcms/payload/releases/tag/v1.7.0", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/payloadcms/payload/releases/tag/v1.7.0"}]}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-30843", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-03T16:45:52.366862Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-03T16:45:40.472Z"}}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "DB7D9BC3-D021-4727-9F6E-DE1293B08E03", "versionEndExcluding": "1.7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Version 1.7.0 contains a patch. As a workaround, write a `beforeOperation` hook to remove `where` queries that attempt to access hidden field data."}], "id": "CVE-2023-30843", "lastModified": "2024-11-21T08:00:57.300", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-04-26T21:15:09.177", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/payloadcms/payload/releases/tag/v1.7.0"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/payloadcms/payload/security/advisories/GHSA-35jj-vqcf-f2jf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/payloadcms/payload/releases/tag/v1.7.0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/payloadcms/payload/security/advisories/GHSA-35jj-vqcf-f2jf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}]}