CVE-2023-48218CWE-863

Strapi Protected Populate Plugin leaking fields if the request fields where empty or only fields selected where not populatable

Medium · published November 20, 2023

CVSS v3.1
5.3
EPSS
1%
Percentile
48.1
In the wild
Unconfirmed
What it is

The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate those fields anyway. This issue has been patched in version 1.3.4. There are no known workarounds.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00601 · 48.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2023-11-20T17:09Z
EPSS history
Timeline
  • 20 NOV 17:09Z
    Strapi Protected Populate Plugin leaking fields if the request fields where empty or only fields selected where not populatable
    cvelistv5