CVE-2023-48218

    Dashboard / Vulnerabilities / CVE-2023-48218

    CVE-2023-48218

    Published: 20 Nov 2023Last Modified: 12 Aug 2026

    Summary: Strapi Protected Populate Plugin leaking fields if the request fields where empty or only fields selected where not populatable

    Details: The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate those fields anyway. This issue has been patched in version 1.3.4. There are no known workarounds.

    References: https://github.com/strapi-community/strapi-plugin-protected-populate/releases/tag/v1.3.4, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48218.json, https://github.com/strapi-community/strapi-plugin-protected-populate/security/advisories/GHSA-6h67-934r-82g7, https://nvd.nist.gov/vuln/detail/CVE-2023-48218, https://github.com/strapi-community/strapi-plugin-protected-populate/commit/05441066d64e09dd55937d9f089962e9ebe2fb39

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -64525995eccae763869a30d28ea4dc7f88f03e40

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-48218 | CVE-DB