CVE-2023-22894: Strapi Cleartext Storage of Sensitive Information Vulnerability

According to The Hacker News, CVE-2023-22894 is a cleartext storage of sensitive information vulnerability in Strapi that could allow an attacker with access to the admin panel to discover sensitive user details via the query filter[1], and carries a CVSS score of 7.2.The CVE record, as reproduced by RedPacket Security, says that if the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users.[2]CISA's catalog entry states that the flaw can be chained with CVE-2023-22621 to achieve remote code execution.[3] CISA also says the affected products could be end-of-life (EoL) and/or end-of-service (EoS).[3]7IT News reports that the other four additions affect ONLYOFFICE Docs (CVE-2021-3199), Apache Struts (CVE-2016-3081), ISC BIND (CVE-2015-5477) and ProFTPD (CVE-2015-3306).[4]Security Affairs reports that CISA orders federal agencies to fix the flaws by October 11, 2026.[5]Strapi's own 2023 disclosure told users to "Immediately update your Strapi to version >4.8.0!"[6] The analyst firm Innovation Network Design advises that "since the flaw exposes password hashes and reset tokens, rotate admin credentials after upgrading."[7]The Hacker News quotes Chris Butera, CISA's Acting Executive Assistant Director for Cybersecurity, as saying Chinese government-affiliated actors "continue to position themselves within critical infrastructure networks"[1].