Auth bypass in Strapi Protected Populate
CVE-2023-48218
The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate those fields anyway. This issue has been patched in version 1.3.4. There are no known workarounds.
Vulnerability class: Broken Access Control
EPSS: 0.006 (45.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Strapi Protected_populate
- Strapi-community Strapi-plugin-protected-populate — versions < 1.3.4
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2023-48218?
- CVE-2023-48218 is a medium-severity vulnerability in Strapi Protected Populate, classified under Incorrect Authorization. CVSS score: 5.3/10. Published 2023-11-20.
- How severe is CVE-2023-48218?
- Medium severity. CVSS v3 base score is 5.3 out of 10.