Strapi: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 3

• High 7.2
  CVE-2023-22894 Exploited Public exploit

  Strapi leaking sensitive user information by filtering on private fields

  Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the …

  @strapi/strapi npm
  Apr 19, 2023

  KEV Oct 8, 2026
• Critical 10.0
  CVE-2023-22621 Public exploit Scanner template EPSS 71%

  Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin

  Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the serve…

  @strapi/plugin-users-permissions @strapi/plugin-email npm
  Apr 19, 2023
• High 8.2
  CVE-2023-22893 Scanner template

  Strapi does not verify the access or ID tokens issued during the OAuth flow

  Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authen…

  @strapi/plugin-users-permissions npm
  Apr 19, 2023

Revision history

1. 2026-10-12 #2

   Exploit aufgenommen CVE-2023-22894

2. 2023-04-19 #1

   Initiale Fassung

References

• strapi Security Disclosure of Vulnerabilities vom 2023-04-19
  https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve
• Exploit CVE-2023-22894
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog