Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS02aDY3LTkzNHItODJnN84AA3RQ

Bypass of field access control in strapi-plugin-protected-populate

Impact

Users are able to bypass the field level security. This means fields that they where not allowed to populate could be populated anyway even in the event that they tried to populate something that they don't have access to.

Patches

This issue has been patched in 1.3.4

Workarounds

None

Permalink: https://github.com/advisories/GHSA-6h67-934r-82g7
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02aDY3LTkzNHItODJnN84AA3RQ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 6 months ago
Updated: 6 months ago

CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Identifiers: GHSA-6h67-934r-82g7, CVE-2023-48218
References:

• https://github.com/strapi-community/strapi-plugin-protected-populate/security/advisories/GHSA-6h67-934r-82g7
• https://nvd.nist.gov/vuln/detail/CVE-2023-48218
• https://github.com/strapi-community/strapi-plugin-protected-populate/commit/05441066d64e09dd55937d9f089962e9ebe2fb39
• https://github.com/strapi-community/strapi-plugin-protected-populate/releases/tag/v1.3.4
• https://github.com/advisories/GHSA-6h67-934r-82g7

Repository: https://github.com/strapi-community/strapi-plugin-protected-populate
Blast Radius: 0.0

Affected Packages