CVE-2022-30617 json
Improper Removal of Sensitive Information Before Storage or Transfer in Strapi
published 2022-05-19 4 y ago modified 2026-06-17 4 mo ago also GHSA-f6fm-r26q-p747 , EUVD-2022-3703
- cvss
- 8.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.5%
- EPSS 1.5% chance of exploitation in 30 days, percentile 73%
- public exploits
- 0
- none known
Summary
An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship (e.g., created by, updated by) with content accessible to the authenticated user. For example, a low-privileged “author” role account can view these details in the JSON response for an “editor” or “super admin” that has updated one of the author’s blog posts. There are also many other scenarios where such details from other users can leak in the JSON response, either through a direct or indirect relationship. Access to this information enables a user to compromise other users’ accounts by successfully invoking the password reset workflow. In a worst-case scenario, a low-privileged user could get access to a “super admin” account with full control over the Strapi instance, and could read and modify any data as well as block access to both the admin panel and API by revoking privileges for all other users.
Patch / fix
- npm strapi 3.6.9
- npm @strapi/strapi 4.0.0-beta.15
- strapi strapi 3.6.10
Exploit prediction
1.47% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | strapi | >=3.0.0, <3.6.9 |
3.6.9 |
| npm | @strapi/strapi | <4.0.0-beta.15 |
4.0.0-beta.15 |
Affected products
- Strapi Strapi
Classification
- Weakness
-
- CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer
References
-
synopsys.com
/blogs/software-security/cyrc-advisory-strapi
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-30617
advisory
-
github.com
/strapi/strapi
package
Sources
- CVE List CVE-2022-30617
- GitHub Advisory GHSA-f6fm-r26q-p747
- NVD CVE-2022-30617
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.