{
  "crds_version": "0.1",
  "kind": "base",
  "id": "crds:cve-2023-22894",
  "revision": 1,
  "title": "Strapi — Admin Query Filter Leaks Password Hashes and Tokens",
  "summary": "Strapi through 4.5.5 lets an attacker with admin panel access infer sensitive user data through the query filter. With super admin access that includes every user's password hash and reset token. It can be chained with CVE-2023-22621 for RCE.",
  "source_type": "cve",
  "severity": "high",
  "cvss": {
    "score": 4.9,
    "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
    "version": "3.1"
  },
  "epss": 0.04114,
  "exploitation": {
    "known_exploited": true,
    "exploit_available": true,
    "attack_complexity": "low",
    "kev_added": "2026-10-08",
    "kev_due": "2026-10-11",
    "prerequisites": "Access to the Strapi admin panel. Super admin access reveals the most."
  },
  "kill_chain": "credential_access",
  "recommended_action": "Move to a supported Strapi version, since affected releases may be end of life, then reset admin passwords and tokens.",
  "confidence": "high",
  "provenance": [
    {
      "fields": [
        "cvss",
        "exploitation.attack_complexity",
        "exploitation.exploit_available",
        "published_at",
        "references"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2023-22894",
      "retrieved_at": "2026-11-05T08:06:18.021Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "exploitation.known_exploited",
        "exploitation.kev_added",
        "exploitation.kev_due"
      ],
      "source": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "retrieved_at": "2026-11-05T08:06:18.021Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "epss"
      ],
      "source": "https://api.first.org/data/v1/epss?cve=CVE-2023-22894",
      "retrieved_at": "2026-11-05T08:06:18.021Z",
      "confidence": "high",
      "extractor": "scrty-crds-pipeline/0.1"
    },
    {
      "fields": [
        "title",
        "subtitle",
        "summary",
        "severity",
        "remediation",
        "mitre_attack",
        "kill_chain",
        "recommended_action",
        "confidence",
        "tags",
        "exploitation.prerequisites"
      ],
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2023-22894",
      "retrieved_at": "2026-11-05T08:06:18.021Z",
      "confidence": "high",
      "extractor": "claude-code"
    }
  ],
  "references": [
    {
      "type": "cve",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22894",
      "label": "NVD record"
    },
    {
      "type": "cisa",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "label": "CISA Known Exploited Vulnerabilities catalog"
    },
    {
      "type": "exploit",
      "url": "https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve"
    },
    {
      "type": "exploit",
      "url": "https://www.ghostccamm.com/blog/multi_strapi_vulns/"
    }
  ],
  "published_at": "2023-04-19T16:15:07.303Z",
  "issued_at": "2026-11-05T08:06:18.021Z",
  "tags": [
    "strapi",
    "information-disclosure"
  ]
}