{"vulnerability": "CVE-2023-22894", "sightings": [{"uuid": "f495bc73-ed2b-469a-bf4a-8548f64f96d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-22894", "type": "published-proof-of-concept", "source": "https://t.me/ptswarm/170", "content": "Multiple Critical Vulnerabilities in Strapi Versions <=4.7.1\n\n\ud83d\udc64 by GhostCcamm\n\nStrapi had multiple critical vulnerabilities that could be chained together to gain Unauthenticated Remote Code Execution. This is GhostCcamm's public disclosure of the vulnerabilities he found in Strapi, how they were patched and some nonsensical ramblings.\n\n\ud83d\udcdd Contents:\n\u25cf Overview \n\u25cf TL;DR\n\u25cf Disclaimers\n\u25cf CVE-2023-22893\n\u25cf CVE-2023-22621\n\u25cf CVE-2023-22894\n\u25cf Chaining CVE-2023-22621 and CVE-2023-22894 Together to Achieve Unauthenticated RCE \n\u25cf Indicators of Compromise \n\u25cf Conclusion \n\nhttps://www.ghostccamm.com/blog/multi_strapi_vulns/", "creation_timestamp": "2023-04-18T09:12:23.000000Z"}, {"uuid": "8fc136ba-2ee2-4e37-b895-bc75e4ffe6ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-22894", "type": "seen", "source": "Telegram/pD-oLW4y0XW4yFER1BFQ6URql9YMKhYuONoBuEocaLRzSF5v", "content": "", "creation_timestamp": "2025-02-06T02:44:19.000000Z"}, {"uuid": "e02f4128-905b-4f26-a630-b5cd46964534", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-22894", "type": "published-proof-of-concept", "source": "Telegram/BDIuQxJm2Cl1hcH3rBtjVuiBaQPlmqaGA0Zegr2NgVBdQWM", "content": "", "creation_timestamp": "2023-04-18T17:16:58.000000Z"}, {"uuid": "b69a9816-86f5-43a1-a31f-6b8ad6e165fc", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-22894", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/de5367c0-5e0d-420e-b522-9922af9a9652", "content": "", "creation_timestamp": "2026-10-08T18:00:02.614415Z"}, {"uuid": "9def3a3c-8261-4795-8473-3121036e30b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-22894", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mxf22y4pwj23", "content": "\ud83d\uded1 CVE-2023-22894\nStrapi Strapi\nCVSS 4.9 / EPSS 2% / KEV: No\nTL;DR: Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive \u2026\nhttps://cvesentinel.com/report/CVE-2023-22894?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-10-08T18:00:31.213625Z"}, {"uuid": "dbef960d-ae64-4f96-9011-c7480a8d65c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-22894", "type": "seen", "source": "https://bsky.app/profile/aipostdaily.bsky.social/post/3mxf35wn26v2l", "content": "CISA added CVE-2023-22894 to its Known Exploited Vulnerabilities list (2026-10-08).\nStrapi Cleartext Storage of Sensitive Information\nEPSS 30 days before listing: 0.017 \u00b7 today: 0.017\n#infosec #KEV", "creation_timestamp": "2026-10-08T18:20:04.648694Z"}, {"uuid": "b1f2e071-4cf3-4db4-8ac8-6293dd15fb15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-22894", "type": "seen", "source": "https://bsky.app/profile/ninjaintelgroup.bsky.social/post/3mxf6bisoj32x", "content": "\ud83d\udea8 NEW on CISA KEV \u2014 exploited in the wild\nStrapi Strapi: Strapi Cleartext Storage of Sensitive Information Vulnerability\nCVE-2023-22894 \u00b7 patch by 2026-10-11\n\ud83d\udd17 https://ninjasignal.ninja/intel/cve/CVE-2023-22894\n#KEV #cybersecurity #infosec", "creation_timestamp": "2026-10-08T19:15:44.735122Z"}, {"uuid": "188a66bb-f1e3-4b61-9afa-823392bdded3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-22894", "type": "seen", "source": "https://infosec.exchange/users/secdb/statuses/117406827249675241", "content": "\ud83d\udea8 [CISA-2026:1008] CISA Adds 5 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1008)\nCISA has added 5 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.\n\u26a0\ufe0f CVE-2015-3306 (https://secdb.nttzen.cloud/cve/detail/CVE-2015-3306)- Name: ProFTPD Improper Access Control Vulnerability- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.- Known To Be Used in Ransomware Campaigns? Unknown- Vendor: ProFTPD- Product: ProFTPD- Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: http://www.proftpd.org/ ; https://lists.debian.org/debian-security-announce/2015/msg00154.html ; https://lists.opensuse.org/archives/list/updates@lists.opensuse.org/message/WE6YZRG5UVXMGQ7IVDRYBPIWV4M6UUGM/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2015-3306\n\u26a0\ufe0f CVE-2015-5477 (https://secdb.nttzen.cloud/cve/detail/CVE-2015-5477)- Name:  ISC BIND Data Processing Errors Vulnerability- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.- Known To Be Used in Ransomware Campaigns? Unknown- Vendor: ISC- Product: BIND- Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://web.archive.org/web/20150729014733/https://kb.isc.org/article/AA-01272 ; https://access.redhat.com/errata/RHSA-2015:1513.html; https://supportportal.juniper.net/s/article/2016-01-Security-Bulletin-Junos-Vulnerability-in-ISC-BIND-named-CVE-2015-5477 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2015-5477\n\u26a0\ufe0f CVE-2016-3081 (https://secdb.nttzen.cloud/cve/detail/CVE-2016-3081)- Name: Apache Struts Command Injection Vulnerability- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.- Known To Be Used in Ransomware Campaigns? Unknown- Vendor: Apache- Product: Struts- Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://cwiki.apache.org/confluence/display/WW/S2-032 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2016-3081\n\u26a0\ufe0f CVE-2021-3199 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-3199)- Name: ONLYOFFICE Docs Server Path Traversal Vulnerability- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.- Known To Be Used in Ransomware Campaigns? Unknown- Vendor: ONLYOFFICE- Product: Docs- Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://github.com/ONLYOFFICE/DocumentServer/blob/903fe5ab7a275bd69c3c3346af2d21cf87ebeabf/CHANGELOG.md#563 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2021-3199\n\u26a0\ufe0f CVE-2023-22894 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-22894)- Name: Strapi Cleartext Storage of Sensitive Information Vulnerability- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.- Known To Be Used in Ransomware Campaigns? Unknown- Vendor: Strapi- Product: Strapi- Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve ; https://github.com/strapi/strapi/releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2023-22894\n#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261008 #cisa20261008 #cve_2015_3306 #cve_2015_5477 #cve_2016_3081 #cve_2021_3199 #cve_2023_22894 #cve20153306 #cve20155477 #cve20163081 #cve20213199 #cve202322894", "creation_timestamp": "2026-10-08T20:05:51.155466Z"}, {"uuid": "1a21a6f9-547d-4fe9-813c-23669332bd8c", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-22894", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c6e1ed85-a8fa-48e8-9dff-6523817a5315", "content": "", "creation_timestamp": "2026-10-09T06:14:13.224194Z"}, {"uuid": "0ddc7c46-5ed3-490e-a0b1-dc216c11ea4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-22894", "type": "seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mxgdzdlyqa2u", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2023-22894: \u26a0\ufe0f CVE-2023-22894: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 1.7%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2023-22894-strapi-through-455-allows-attackers-with", "creation_timestamp": "2026-10-09T06:31:13.000812Z"}, {"uuid": "9dd4a06c-4f9c-4227-b1f5-1667f251c962", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-22894", "type": "seen", "source": "https://bsky.app/profile/cybowl.bsky.social/post/3mxghb6xttr2g", "content": "\ud83d\udd34 Exploitation confirm\u00e9e (CISA KEV, ajouts du 08/10) \u00b7 5\n\u2022 ProFTPD CVE-2015-3306, CVSS 10.0\n\u2022 ISC BIND CVE-2015-5477, CVSS 7.5\n\u2022 Apache Struts CVE-2016-3081, CVSS 8.1\n\u2022 ONLYOFFICE Docs CVE-2021-3199, CVSS 9.8\n\u2022 Strapi CVE-2023-22894, CVSS 4.9", "creation_timestamp": "2026-10-09T07:29:18.144985Z"}, {"uuid": "13d4533d-a1d8-475c-ba42-7be745a1b439", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-22894", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3mxgmpnxesf27", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2023-22894: Strapi Cleartext Storage of Sensitive Information Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2023-22894", "creation_timestamp": "2026-10-09T09:06:52.324197Z"}]}