high Known exploitedREV. 01
CVE-2023-22894Strapi — Admin Query Filter Leaks Password Hashes and Tokens
Strapi through 4.5.5 lets an attacker with admin panel access infer sensitive user data through the query filter. With super admin access that includes every user's password hash and reset token. It can be chained with CVE-2023-22621 for RCE.
Read the risk
THE VITAL STATS- CVSS score
- 4.9/ 10 CVSS v3.1
- EPSS probability
- 4.1% Likelihood of exploitation
- Attack complexity
- Low Conditions needed to exploit
- Known exploited
- Yes — CISA KEV
- CVE published
- 2023-04-19
- Added to KEV
- 2026-10-08
- CISA due date
- 2026-10-11
- Exploit published
- Yes
- Confidence
- high
- Kill chain
- credential access
- MITRE ATT&CK
- —
- Severity
- high
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attacker needsAccess to the Strapi admin panel. Super admin access reveals the most.
Behind the card
4 REFERENCES- 01CVE recordNVD recordnvd.nist.gov
- 02CISACISA Known Exploited Vulnerabilities catalogcisa.gov
- 03Exploitstrapi.iostrapi.io
- 04Exploitghostccamm.comghostccamm.com
Field-level provenanceTRACE THE SOURCES +
Which source supports each field, when it was retrieved, and who extracted it.
| Fields | Source | Retrieved | Extractor | Confidence |
|---|---|---|---|---|
| cvss, exploitation.attack_complexity, exploitation.exploit_available, published_at, references | nvd.nist.gov | 2026-11-05 | scrty-crds-pipeline/0.1 | high |
| exploitation.known_exploited, exploitation.kev_added, exploitation.kev_due | cisa.gov | 2026-11-05 | scrty-crds-pipeline/0.1 | high |
| epss | api.first.org | 2026-11-05 | scrty-crds-pipeline/0.1 | high |
| title, subtitle, summary, severity, remediation, mitre_attack, kill_chain, recommended_action, confidence, tags, exploitation.prerequisites | nvd.nist.gov | 2026-11-05 | claude-code | high |
Printing history
THE RECORD- r1Initial base card
History unavailable — this build has no Git history for the card file.