Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.
Weakness
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Payload | Payloadcms | 3.0.0 (including) | 3.90.0 (excluding) |
| Payload | Payloadcms | 4.0.0-canary0 (including) | 4.0.0-canary0 (including) |
| Payload | Payloadcms | 4.0.0-canary1 (including) | 4.0.0-canary1 (including) |
| Payload | Payloadcms | 4.0.0-canary10 (including) | 4.0.0-canary10 (including) |
| Payload | Payloadcms | 4.0.0-canary11 (including) | 4.0.0-canary11 (including) |
| Payload | Payloadcms | 4.0.0-canary12 (including) | 4.0.0-canary12 (including) |
| Payload | Payloadcms | 4.0.0-canary13 (including) | 4.0.0-canary13 (including) |
| Payload | Payloadcms | 4.0.0-canary14 (including) | 4.0.0-canary14 (including) |
| Payload | Payloadcms | 4.0.0-canary15 (including) | 4.0.0-canary15 (including) |
| Payload | Payloadcms | 4.0.0-canary16 (including) | 4.0.0-canary16 (including) |
| Payload | Payloadcms | 4.0.0-canary17 (including) | 4.0.0-canary17 (including) |
| Payload | Payloadcms | 4.0.0-canary18 (including) | 4.0.0-canary18 (including) |
| Payload | Payloadcms | 4.0.0-canary19 (including) | 4.0.0-canary19 (including) |
| Payload | Payloadcms | 4.0.0-canary2 (including) | 4.0.0-canary2 (including) |
| Payload | Payloadcms | 4.0.0-canary20 (including) | 4.0.0-canary20 (including) |
| Payload | Payloadcms | 4.0.0-canary21 (including) | 4.0.0-canary21 (including) |
| Payload | Payloadcms | 4.0.0-canary22 (including) | 4.0.0-canary22 (including) |
| Payload | Payloadcms | 4.0.0-canary23 (including) | 4.0.0-canary23 (including) |
| Payload | Payloadcms | 4.0.0-canary24 (including) | 4.0.0-canary24 (including) |
| Payload | Payloadcms | 4.0.0-canary25 (including) | 4.0.0-canary25 (including) |
| Payload | Payloadcms | 4.0.0-canary26 (including) | 4.0.0-canary26 (including) |
| Payload | Payloadcms | 4.0.0-canary27 (including) | 4.0.0-canary27 (including) |
| Payload | Payloadcms | 4.0.0-canary28 (including) | 4.0.0-canary28 (including) |
| Payload | Payloadcms | 4.0.0-canary29 (including) | 4.0.0-canary29 (including) |
| Payload | Payloadcms | 4.0.0-canary3 (including) | 4.0.0-canary3 (including) |
| Payload | Payloadcms | 4.0.0-canary30 (including) | 4.0.0-canary30 (including) |
| Payload | Payloadcms | 4.0.0-canary31 (including) | 4.0.0-canary31 (including) |
| Payload | Payloadcms | 4.0.0-canary32 (including) | 4.0.0-canary32 (including) |
| Payload | Payloadcms | 4.0.0-canary33 (including) | 4.0.0-canary33 (including) |
| Payload | Payloadcms | 4.0.0-canary4 (including) | 4.0.0-canary4 (including) |
| Payload | Payloadcms | 4.0.0-canary5 (including) | 4.0.0-canary5 (including) |
| Payload | Payloadcms | 4.0.0-canary6 (including) | 4.0.0-canary6 (including) |
| Payload | Payloadcms | 4.0.0-canary7 (including) | 4.0.0-canary7 (including) |
| Payload | Payloadcms | 4.0.0-canary8 (including) | 4.0.0-canary8 (including) |
| Payload | Payloadcms | 4.0.0-canary9 (including) | 4.0.0-canary9 (including) |
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/21.html
- https://cwe.mitre.org/data/definitions/22.html
- https://cwe.mitre.org/data/definitions/459.html
- https://cwe.mitre.org/data/definitions/461.html
- https://cwe.mitre.org/data/definitions/473.html
- https://cwe.mitre.org/data/definitions/476.html
- https://cwe.mitre.org/data/definitions/59.html
- https://cwe.mitre.org/data/definitions/60.html
- https://cwe.mitre.org/data/definitions/667.html
- https://cwe.mitre.org/data/definitions/94.html