CVE-2023-22894 Strapi Strapi
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the…
- CVSS
- 7.2 High
- EPSS
- 4.1%
- Percentile
- 91
- Published
- 2023-04-19
- Force
- 9 of 12
- Public PoC
- 2
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
On CISA’s exploited list
Strapi Cleartext Storage of Sensitive Information Vulnerability
- Added
- 2026-10-08
- Federal patch deadline
- 2026-10-11
- Ransomware use
- not known