CVE-2023-22894: Strapi Cleartext Storage of Sensitive Information Vulnerability
Summary: CVE-2023-22894 is a cleartext storage of sensitive information vulnerability in Strapi that lets attackers with admin panel access discover sensitive user details through the query filter. CISA notes the affected product may be end-of-life or end-of-service, advises discontinuing use or moving to a supported version, and states the flaw can be chained with CVE-2023-22621 to achieve remote code execution.
Key Takeaway: The exposure starts with admin panel access and ends in remote code execution when chained with CVE-2023-22621, so a single set of privileged credentials can carry an attacker all the way to code execution on the host.
Read the original at CISA KEV Catalog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-22894Strapi
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026