EXPOSURES › CVE-2023-22894
CVE-2023-22894
HIGH ⌖ ON CISA KEV · EXPLOITEDStrapi's cleartext storage of sensitive data in its admin panel allows attackers to discover user details, which can be chained with another vulnerability for remote code execution.
Strapi stores sensitive information in cleartext within its admin panel, enabling attackers with admin access to extract user details via query filters. This is a critical failure for DIB organizations because it violates data protection requirements and can be chained with CVE-2023-22621 to achieve remote code execution, leading to full system compromise. Organizations must ensure they are using supported versions and patching known vulnerabilities promptly to avoid similar exposures.
Shame score — Storing sensitive data in cleartext is a fundamental security negligence that is easily exploitable and can be chained with other vulnerabilities to achieve remote code execution, causing severe data exposure and system compromise.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.