PT-2023-30736 · Strapi · Strapi Protected Populate Plugin

Boegie19 · Publicado 2023-11-20 · Atualizado 2023-11-29 · CVE-2023-48218

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Strapi Protected Populate Plugin versions prior to 1.3.4

Description The issue allows users to bypass field level security, enabling them to populate fields they do not have access to. This affects get endpoints, which are protected by the Strapi Protected Populate Plugin to prevent revealing too much information.

Recommendations For versions prior to 1.3.4, update to version 1.3.4 to resolve the issue. As a temporary workaround, consider restricting access to sensitive fields until the update can be applied. Avoid using the get endpoints to populate sensitive fields until the issue is resolved.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2023-48218

GHSA-6H67-934R-82G7

Produtos afetados

Strapi Protected Populate Plugin

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48218.json · Exploit
• https://github.com/strapi-community/strapi-plugin-protected-populate/security/advisories/GHSA-6h67-934r-82g7 · Aviso do Fabricante
• https://github.com/strapi-community/strapi-plugin-protected-populate/releases/tag/v1.3.4 · Nota
• https://github.com/strapi-community/strapi-plugin-protected-populate · Nota
• https://github.com/strapi-community/strapi-plugin-protected-populate/commit/05441066d64e09dd55937d9f089962e9ebe2fb39 · Correção
• https://t.me/cvenotify/61543 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-48218 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-48218 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-6h67-934r-82g7 · Aviso do Fabricante