CVE-2023-48218GHSA-6H67-934R-82G7
Strapi Protected Populate Plugin leaking fields if the request fields where empty or only fields selected where not populatable
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.3.4
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate those fields anyway. This issue has been patched in version 1.3.4. There are no known workarounds.
Timeline
- CVE published
- Record last updated
Affected versions
- strapi-community strapi-plugin-protected-populate
fixed in 1.3.4
- strapi-plugin-protected-populatenpm
fixed in 1.3.4