GitHub Advisoryadvisory · npm

GHSA-65wv-528r-m892 Improper Input Validation in strapi

MEDIUM Published 2022-05-24 Modified 2022-06-21 Official page ↗
Aliases
CVE-2020-13961
Ecosystem
npm
Packages
strapi
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20
Reviewed
2022-06-21

Affected packages

• npm strapi: < 3.0.2 → fixed in 3.0.2

Description

Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any sanitation. By sending a specially crafted request, an attacker could exploit this vulnerability to update the email template for both password reset and account confirmation emails.

Related

Alias · CVE (1)

  • CVE-2020-13961 Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References