Information Exposure Affecting @strapi/strapi package, versions >=4.0.0-next.0 <4.8.0
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.15% (52nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-STRAPISTRAPI-5431394
- published 20 Apr 2023
- disclosed 19 Apr 2023
- credit ghostccamm
Introduced: 19 Apr 2023
CVE-2023-22894 Open this link in a new tabHow to fix?
Upgrade @strapi/strapi to version 4.8.0 or higher.
Overview
@strapi/strapi is an updated version of the old 'strapi', which is a free and open-source headless CMS delivering your content anywhere you need.
Affected versions of this package are vulnerable to Information Exposure by revealing sensitive user information (including on Super Administrators) by filtering on private fields (including password reset tokens). This can allow an attacker to hijack a privileged account.
CVSS Scores
version 3.1