CVE-2023-22621
100Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 10epss 77%
from disclosure to weapon6 days
Published on NVDApr 19
1st PoC+6d
VulnCheck+1081d
exploitation probability
77%top 1% of all CVEs
observed exploitation
yesVulnCheck
2 public exploit(s)
Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses the validation checks that should prevent code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
n/a · n/apublic PoCs found — 2
githubgithub.com/sofianeelhor/CVE-2023-22621-POC★ 25vulncheckvulncheck.com/xdb/dcac39802eb9unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.