Security
Loading…

CVE-2023-22894

MEDIUMCVSS 4.9Known Exploited
Description

Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.

Timeline
Published:April 19th, 2023 4:15 PM
Last modified:October 7th, 2026 4:17 AM
Added to KEV:October 8th, 2026
CVSS Scoring

CVSS v3: 4.9 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected Software
From NVD CPE configuration data

Vendors

strapi

Products

strapi
Weaknesses (CWE)

Source: NIST NVD · Data may lag official sources by up to one minute