GHSA-6h67-934r-82g7

Bypass of field access control in strapi-plugin-protected-populate

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-48218

Packages

Ecosystem	Package	Affected	Fixed in
npm	strapi-plugin-protected-populate	< 1.3.4	1.3.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Users are able to bypass the field level security. This means fields that they where not allowed to populate could be populated anyway even in the event that they tried to populate something that they don't have access to. ### Patches This issue has been patched in 1.3.4 ### Workarounds None

References

External links from the advisory. They lead to third-party sites.

https://github.com/strapi-community/strapi-plugin-protected-populate/security/advisories/GHSA-6h67-934r-82g7 web
https://nvd.nist.gov/vuln/detail/CVE-2023-48218 advisory
https://github.com/strapi-community/strapi-plugin-protected-populate/commit/05441066d64e09dd55937d9f089962e9ebe2fb39 web
https://github.com/strapi-community/strapi-plugin-protected-populate package
https://github.com/strapi-community/strapi-plugin-protected-populate/releases/tag/v1.3.4 web