CVE-2023-22894
Last modified
CVE-2023-22894 is a medium-severity vulnerability rated 4.9/10 on the CVSS scale. Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. CISA has confirmed active exploitation in the wild. EPSS estimates a 1.66% chance of exploitation in the next 30 days.
Description
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts.
Metrics
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Strapi | Strapi | >= 3.2.1, < 4.8.0 |
References
- https://github.com/strapi/strapi/releasesRelease Notes
- https://strapi.io/blog/security-disclosure-of-vulnerabilities-cveExploit, Vendor Advisory
- https://www.ghostccamm.com/blog/multi_strapi_vulns/Exploit, Third Party Advisory
- https://github.com/strapi/strapi/releasesRelease Notes
- https://strapi.io/blog/security-disclosure-of-vulnerabilities-cveExploit, Vendor Advisory
- https://www.ghostccamm.com/blog/multi_strapi_vulns/Exploit, Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22894US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2023-22894?
How severe is CVE-2023-22894?
How do I fix CVE-2023-22894?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-22889SmartBear Zephyr Enterprise through 7.15.0 mishandles user-d…9.8
- CVE-2023-2289The wordpress vertical image slider plugin for WordPress is …6.1
- CVE-2023-22890SmartBear Zephyr Enterprise through 7.15.0 allows unauthenti…7.5
- CVE-2023-22891There exists a privilege escalation vulnerability in SmartBe…8.1
- CVE-2023-22892There exists an information disclosure vulnerability in Smar…7.5
- CVE-2023-22893Strapi through 4.5.5 does not verify the access or ID tokens…7.5
- CVE-2023-22895The bzip2 crate before 0.4.4 for Rust allow attackers to cau…7.5
- CVE-2023-22897An issue was discovered in SecurePoint UTM before 12.2.5.1. …6.5
- CVE-2023-22898workers/extractor.py in Pandora (aka pandora-analysis/pandor…6.5
- CVE-2023-22899Zip4j through 2.11.2, as used in Threema and other products,…5.9
- CVE-2023-2290A potential vulnerability in the LenovoFlashDeviceInterface …6.7
- CVE-2023-22900Efence login function has insufficient validation for user i…9.8
Are you affected by CVE-2023-22894?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST