CVE-2023-22894
First published: Wed Apr 19 2023(Updated: )
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Strapi Strapi | >=3.2.1<4.8.0 | |
| npm/@strapi/strapi | >=3.2.1<4.8.0 | 4.8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/strapi/strapi/releases
- https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve
- https://www.ghostccamm.com/blog/multi_strapi_vulns/
- https://github.com/strapi/strapi/security/advisories/GHSA-jjqf-j4w7-92w8
- https://nvd.nist.gov/vuln/detail/CVE-2023-22894
- https://github.com/strapi/strapi/releases/tag/v4.8.0
- https://github.com/advisories/GHSA-jjqf-j4w7-92w8 (Advisory)
Frequently Asked Questions
What is CVE-2023-22894?
CVE-2023-22894 is a vulnerability in Strapi versions up to 4.5.5 that allows attackers with access to the admin panel to discover sensitive user details.
How can an attacker exploit CVE-2023-22894?
An attacker can exploit CVE-2023-22894 by exploiting the query filter in Strapi and filtering users by columns that contain sensitive information.
What is the severity of CVE-2023-22894?
The severity of CVE-2023-22894 is medium with a severity value of 4.9.
How do I fix CVE-2023-22894?
To fix CVE-2023-22894, upgrade Strapi to version 4.8.0 or newer.
Where can I find more information about CVE-2023-22894?
You can find more information about CVE-2023-22894 on the following references: [GitHub](https://github.com/strapi/strapi/releases), [Strapi Blog](https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve), [GhostCamm Blog](https://www.ghostccamm.com/blog/multi_strapi_vulns/).
- collector/nvd-index
- collector/github-advisory-latest
- alias/GHSA-jjqf-j4w7-92w8
- alias/CVE-2023-22894
- collector/nvd-cve
- collector/github-advisory
- vendor/strapi
- canonical/strapi strapi
- version/strapi strapi/3.2.1
- package-manager/npm