CVE-2020-13961

Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any sanitation. By sending a specially crafted request, an attacker could exploit this vulnerability to update the email template for both password reset and account confirmation emails.
References
Link Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/183045 Third Party Advisory VDB Entry
https://github.com/strapi/strapi/pull/6599 Third Party Advisory
https://github.com/strapi/strapi/releases/tag/v3.0.2 Release Notes Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-06-19 17:15

Updated : 2024-02-04 21:00


NVD link : CVE-2020-13961

Mitre link : CVE-2020-13961

CVE.ORG link : CVE-2020-13961


JSON object : View

Products Affected

strapi

  • strapi
CWE
CWE-20

Improper Input Validation