Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensiti…
Medium CVSS 4.9 Listed in CISA KEV
Summary
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API us…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
- Strapi:Strapi
Sources
- NVD DATABASE
- CISA KEV DATABASE
Original Links
- https://github.com/strapi/strapi/releases Release Notes
- https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve Exploit
- https://www.ghostccamm.com/blog/multi_strapi_vulns/ Exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22894
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk reference
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk reference
- https://nvd.nist.gov/vuln/detail/CVE-2023-22894 reference
Timeline
- nvd_ingest NVD
- kev_ingest CISA KEV