Sensitive Data Exposure Vulnerability in Strapi by Strapi

CVE-2023-22894

What is CVE-2023-22894?

Strapi versions up to 4.5.5 are susceptible to a vulnerability that allows an attacker with access to the admin panel to uncover sensitive user details. This can occur through the exploitation of the query filter, enabling the attacker to filter user data fields and deduce sensitive information from API responses. If the attacker holds super admin privileges, they could potentially access critical information such as password hashes and password reset tokens for all users. Furthermore, an attacker with admin panel access to a user account may also retrieve sensitive information related to lower-privileged roles, like Editors or Authors, without risking other admin accounts.

References