CVE-2023-48218

The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate those fields anyway. This issue has been patched in version 1.3.4. There are no known workarounds.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/strapi-community/strapi-plugin-protected-populate/commit/05441066d64e09dd55937d9f089962e9ebe2fb39	Patch
https://github.com/strapi-community/strapi-plugin-protected-populate/releases/tag/v1.3.4	Release Notes
https://github.com/strapi-community/strapi-plugin-protected-populate/security/advisories/GHSA-6h67-934r-82g7	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:strapi:protected_populate:*:*:*:*:*:*:*:*

History

29 Nov 2023, 20:52

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.3
CPE		cpe:2.3:a:strapi:protected_populate::::::::
First Time		Strapi Strapi protected Populate
References	~~() https://github.com/strapi-community/strapi-plugin-protected-populate/commit/05441066d64e09dd55937d9f089962e9ebe2fb39 -~~	() https://github.com/strapi-community/strapi-plugin-protected-populate/commit/05441066d64e09dd55937d9f089962e9ebe2fb39 - Patch
References	~~() https://github.com/strapi-community/strapi-plugin-protected-populate/releases/tag/v1.3.4 -~~	() https://github.com/strapi-community/strapi-plugin-protected-populate/releases/tag/v1.3.4 - Release Notes
References	~~() https://github.com/strapi-community/strapi-plugin-protected-populate/security/advisories/GHSA-6h67-934r-82g7 -~~	() https://github.com/strapi-community/strapi-plugin-protected-populate/security/advisories/GHSA-6h67-934r-82g7 - Vendor Advisory

20 Nov 2023, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-11-20 17:15

Updated : 2023-12-10 15:26

NVD link : CVE-2023-48218

Mitre link : CVE-2023-48218

CVE.ORG link : CVE-2023-48218

JSON object : View

Products Affected

strapi

protected_populate

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2023-48218", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2023-11-20T17:15:13.543", "references": [{"url": "https://github.com/strapi-community/strapi-plugin-protected-populate/commit/05441066d64e09dd55937d9f089962e9ebe2fb39", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/strapi-community/strapi-plugin-protected-populate/releases/tag/v1.3.4", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/strapi-community/strapi-plugin-protected-populate/security/advisories/GHSA-6h67-934r-82g7", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate those fields anyway. This issue has been patched in version 1.3.4. There are no known workarounds."}, {"lang": "es", "value": "El complemento Strapi Protected Populate protege los endpoints \"get\" para que no revelen demasiada informaci\u00f3n. Antes de la versi\u00f3n 1.3.4, los usuarios pod\u00edan omitir la seguridad a nivel de campo. Los usuarios que intentaron completar algo a lo que no ten\u00edan acceso pod\u00edan completar esos campos de todos modos. Este problema se solucion\u00f3 en la versi\u00f3n 1.3.4. No se conocen workarounds."}], "lastModified": "2023-11-29T20:52:27.770", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:strapi:protected_populate:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7E302923-4968-48AB-BA63-4F0EFA16885B", "versionEndExcluding": "1.3.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}