Strapi Protected Populate Plugin leaking fields if the request fields where empty or only fields selected where not populatable
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.6%
exploitation probability
0.6%top 53% of all CVEs
observed exploitation
nono source reports it
The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field level security. Users who tried to populate something that they didn't have access to could populate those fields anyway. This issue has been patched in version 1.3.4. There are no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
strapi-community · strapi-plugin-protected-populateReferences
https://github.com/strapi-community/strapi-plugin-protected-populate/commit/05441066d64e09dd55937d9f089962e9ebe2fb39https://github.com/strapi-community/strapi-plugin-protected-populate/releases/tag/v1.3.4https://github.com/strapi-community/strapi-plugin-protected-populate/security/advisories/GHSA-6h67-934r-82g7