CVE-2022-30618 json
Improper Removal of Sensitive Information Before Storage or Transfer in Strapi
published 2022-05-19 4 y ago modified 2026-06-17 4 mo ago also GHSA-vgj7-895j-gpr6 , EUVD-2022-5354
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 61%
- public exploits
- 0
- none known
Summary
An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authenticated user contain relationships to API users (from:users-permissions). There are many scenarios in which such details from API users can leak in the JSON response within the admin panel, either through a direct or indirect relationship. Access to this information enables a user to compromise these users’ accounts if the password reset API endpoints have been enabled. In a worst-case scenario, a low-privileged user could get access to a high-privileged API account, and could read and modify any data as well as block access to both the admin panel and API by revoking privileges for all other users.
Patch / fix
- npm strapi 3.6.9
- npm @strapi/strapi 4.1.9
- strapi strapi 3.6.10, 4.1.10
Exploit prediction
0.96% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.0 | AV:N/AC:M/Au:S/C:P/I:P/A:P |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | strapi | >=3.0.0, <3.6.9 |
3.6.9 |
| npm | @strapi/strapi | <4.1.9 |
4.1.9 |
Affected products
- Strapi Strapi
Classification
- Weakness
-
- CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer
References
-
synopsys.com
/blogs/software-security/cyrc-advisory-strapi
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-30618
advisory
-
github.com
/strapi/strapi
package
Sources
- CVE List CVE-2022-30618
- GitHub Advisory GHSA-vgj7-895j-gpr6
- NVD CVE-2022-30618
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.