~ / search / GHSA-65wv-528r-m892

GHSA-65wv-528r-m892

Improper Input Validation in strapi

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-13961

Packages

EcosystemPackageAffectedFixed in
npm strapi < 3.0.2 3.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any sanitation. By sending a specially crafted request, an attacker could exploit this vulnerability to update the email template for both password reset and account confirmation emails.

References

External links from the advisory. They lead to third-party sites.