Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API…

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2023-22894 · Microsoft / collected KEV context

EUVD-2023-1342

GHSA-jjqf-j4w7-92w8

cve-program · CVE-2023-22894

• https://github.com/strapi/strapi/releases
• https://www.ghostccamm.com/blog/multi_strapi_vulns/
• https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve

euvd · EUVD-2023-1342

• https://github.com/strapi/strapi/releases
• https://www.ghostccamm.com/blog/multi_strapi_vulns/
• https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve

nvd · CVE-2023-22894

• https://github.com/strapi/strapi/releases
• https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve
• https://www.ghostccamm.com/blog/multi_strapi_vulns/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22894

osv · GHSA-jjqf-j4w7-92w8

• https://github.com/strapi/strapi/security/advisories/GHSA-jjqf-j4w7-92w8
• https://nvd.nist.gov/vuln/detail/CVE-2023-22894
• https://github.com/strapi/strapi
• https://github.com/strapi/strapi/releases
• https://github.com/strapi/strapi/releases/tag/v4.8.0
• https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve
• https://www.ghostccamm.com/blog/multi_strapi_vulns

No related operational record is retained in the current change model.