Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments)
Vulnerability Description
Payload is a free and open source headless content management system. Prior to 3.74.0, a cross-collection Insecure Direct Object Reference (IDOR) vulnerability exists in the payload-preferences internal collection. In multi-auth collection environments using Postgres or SQLite with default serial/auto-increment IDs, authenticated users from one auth collection can read and delete preferences belonging to users in different auth collections when their numeric IDs collide. This vulnerability has been patched in v3.74.0.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Vulnerability Type
通过用户控制密钥绕过授权机制
Vulnerability Title
Payload 安全漏洞
Vulnerability Description
Payload是一个使用 TypeScript、Node.js、React 和 MongoDB 构建的 Headless CMS 和应用程序框架。 Payload 3.74.0之前版本存在安全漏洞，该漏洞源于payload-preferences内部集合存在跨集合不安全的直接对象引用漏洞，在使用默认序列或自增ID的多身份验证集合环境中，来自一个身份验证集合的经过身份验证的用户可以在其数字ID冲突时读取和删除属于不同身份验证集合用户的偏好设置。
CVSS Information
N/A
Vulnerability Type
N/A