What is GHSA-6h67-934r-82g7?

GHSA-6h67-934r-82g7 is a security advisory published by GitHub Security Advisories with Medium severity. Bypass of field access control in strapi-plugin-protected-populate

Which CVE IDs does GHSA-6h67-934r-82g7 cover?

GHSA-6h67-934r-82g7 covers the following CVE IDs: CVE-2023-48218. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6h67-934r-82g7?

GHSA-6h67-934r-82g7 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-6h67-934r-82g7?

GHSA-6h67-934r-82g7 affects 1 product, including: npm/strapi-plugin-protected-populate:\u003c 1.3.4.

GHSA-6h67-934r-82g7MediumCVSS 5.3

Bypass of field access control in strapi-plugin-protected-populate

Vendor

GitHub Security Advisories

Published

November 20, 2023

Last Modified

November 20, 2023

🔗 CVE IDs covered (1)

CVE-2023-48218 →

📋 Description

Impact

Users are able to bypass the field level security. This means fields that they where not allowed to populate could be populated anyway even in the event that they tried to populate something that they don't have access to.

Patches

This issue has been patched in 1.3.4

Workarounds

None

🎯 Affected products1

npm/strapi-plugin-protected-populate:< 1.3.4

🔗 References (5)

https://github.com/strapi-community/strapi-plugin-protected-populate/security/advisories/GHSA-6h67-934r-82g7
https://nvd.nist.gov/vuln/detail/CVE-2023-48218
https://github.com/strapi-community/strapi-plugin-protected-populate/commit/05441066d64e09dd55937d9f089962e9ebe2fb39
https://github.com/strapi-community/strapi-plugin-protected-populate/releases/tag/v1.3.4
https://github.com/advisories/GHSA-6h67-934r-82g7