Bypass of field access control in strapi-plugin-protected-populate

中 5.3CVE-2023-48218 · GHSA-6h67-934r-82g7 · 20/11/2023 公開 · 17/06/2026 更新

要点

CVE-2023-48218 は protected populate (strapi), strapi-plugin-protected-populate に影響する深刻度「中」 (CVSS 5.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.60%（全脆弱性の 48.8% より高い）。
対処：1.3.4 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
protected populate strapi	`< 1.3.4`	`1.3.4`
strapi-plugin-protected-populate npm	`< 1.3.4`	`1.3.4`

概要

Impact

Users are able to bypass the field level security. This means fields that they where not allowed to populate could be populated anyway even in the event that they tried to populate something that they don't have access to.

Patches

This issue has been patched in 1.3.4

Workarounds

None

NVD の説明

The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate those fields anyway. This issue has been patched in version 1.3.4. There are no known workarounds.