Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies
CISA added five Flax Typhoon-exploited flaws to the KEV catalog, with a federal patch deadline of October 11.
86
CVE-2023-22894
Sensitive-data leak in Strapi admin query filters (through 4.5.5)
CISA: Strapi Cleartext Storage of Sensitive Information Vulnerability
- CVSS 3.1
- 4.9 medium
- EPSS
- 4%p91
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
CVE-2023-22894 is a sensitive-information disclosure flaw (CWE-312) in Strapi through version 4.5.5. An attacker who already has admin-panel access can use query filters on user records to infer values stored in sensitive columns from API responses. Super-admin access can reveal password hashes and password-reset tokens for all users; an admin who can view username and email of lower-privileged API users (such as Editor or Author) can expose sensitive details for those API users but not other admin accounts. The CVSS 3.1 score is 4.9 because confidentiality impact is high while high privileges are required. CISA lists it in the Known Exploited Vulnerabilities catalog (added 2026-10-08) with ransomware use unknown, and public write-ups exist.
What to do: Upgrade Strapi to a release newer than 4.5.5 per the vendor security advisory, and limit admin-panel access to trusted accounts and networks with least privilege. If admin access may have been misused, rotate credentials, invalidate password-reset tokens, and review logs for unusual user queries. Apply CISA BOD 26-04 patching guidance for exposed assets, or discontinue use if a vendor fix cannot be applied.
| Product | Affected |
|---|---|
| Strapi | through 4.5.5 |
Estimated exposure
largeon the order of 10,000–100,000 Strapi deployments (not all still on versions through 4.5.5) — Strapi is a widely used open-source headless CMS with a large GitHub and npm footprint, but the source data has no install census or internet-scan count, so this is an order-of-magnitude estimate of deployments rather than confirmed…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts.
KEVCISA Known Exploited Vulnerability
- Affected
- Strapi Strapi
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
In the news
6 storiesFBI disrupts Chinese hacking tools used to breach critical infrastructure
FBI seized Flax Typhoon domains for tools used in critical-infrastructure intrusions.
86
US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwide
FBI seized seven Flax Typhoon-linked domains as seven governments warned of PRC data theft.
82
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
Joint advisory says Integrity Technology Group-enabled Chinese actors steal data from critical infrastructure using botnets and hands-on hacking.
82
FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails
FBI and six countries say China-linked Integrity Technology Group stole emails and shared them via a third-party portal.
79
U.S. CISA adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND flaws to its Known Exploited Vulnerabilities catalog
CISA added five exploited ProFTPD, ONLYOFFICE, Strapi, Struts, and BIND flaws to the KEV catalog.
78