---
title: "Security digest: April 17, 2023"
url: https://erroneo.us/security/2023-04-17/
description: "April 17, 2023 vulnerability digest: 1 brief (Strapi CVE-2023-22894: 2023 Password-Hash Leak…). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2023-04-17
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: April 17, 2023

1 editorial brief.

## Take stock

- Check exposure: Strapi CVE-2023-22894: 2023 Password-Hash Leak Now in KEV . Anyone running Strapi v3 (from 3.2.1) or v4 below 4.8.0, especially internet-facing instances with publicly readable collections; v4.5.5 and older are also open to remote code execution through CVE-2023-22621.
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Check exposure** [Strapi CVE-2023-22894: 2023 Password-Hash Leak Now in KEV](https://erroneo.us/security/briefs/strapi-cve-2023-22894-private-field-leak-kev/index.md): Only Strapi builds older than 4.8.0 (March 2023) are affected, but on those an unauthenticated attacker can take over the super admin, so any you find should be upgraded or taken offline today.

## Known exploited (CISA KEV)

None.

## Critical advisories

None.

---
Source page: https://erroneo.us/security/2023-04-17/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt