PT-2023-30736 · Strapi · Strapi Protected Populate Plugin

Boegie19 · Published 2023-11-20 · Updated 2023-11-29 · CVE-2023-48218

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Strapi Protected Populate Plugin versions prior to 1.3.4

Description The issue allows users to bypass field level security, enabling them to populate fields they do not have access to. This affects get endpoints, which are protected by the Strapi Protected Populate Plugin to prevent revealing too much information.

Recommendations For versions prior to 1.3.4, update to version 1.3.4 to resolve the issue. As a temporary workaround, consider restricting access to sensitive fields until the update can be applied. Avoid using the get endpoints to populate sensitive fields until the issue is resolved.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2023-48218

GHSA-6H67-934R-82G7

Affected Products

Strapi Protected Populate Plugin

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48218.json · Exploit
• https://github.com/strapi-community/strapi-plugin-protected-populate/security/advisories/GHSA-6h67-934r-82g7 · Vendor Advisory
• https://github.com/strapi-community/strapi-plugin-protected-populate/commit/05441066d64e09dd55937d9f089962e9ebe2fb39 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-48218 · Security Note
• https://osv.dev/vulnerability/CVE-2023-48218 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6h67-934r-82g7 · Vendor Advisory
• https://github.com/strapi-community/strapi-plugin-protected-populate/releases/tag/v1.3.4 · Note
• https://github.com/strapi-community/strapi-plugin-protected-populate · Note
• https://t.me/cvenotify/61543 · Telegram Post