Source: cisa.gov
Strapi, a popular open-source headless CMS, contains a cleartext storage vulnerability (CVE-2023-22894) that exposes sensitive user information to attackers with admin panel access via query filters. The vulnerability allows discovery of sensitive user details including passwords and tokens in plaintext. Affected versions may be end-of-life or end-of-service, and users are advised to upgrade to a supported version immediately. This vulnerability is particularly dangerous as it can be chained with CVE-2023-22621 to achieve remote code execution. CISA has listed this in its Known Exploited Vulnerabilities catalog under BOD 26-04 prioritization directives. The flaw affects not only Strapi directly but potentially any product or service relying on Strapi as a component or dependency. Organizations using Strapi are urged to apply available patches or migrate to supported versions without delay.
