CVE-2020-13961

CVE-2020-13961

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any sanitation. By sending a specially crafted request, an attacker could exploit this vulnerability to update the email template for both password reset and account confirmation emails.

CVSS 6.5 · Medium · EPSS 1.7% · Fix available

Published

2020-06-19T16:29:37.000Z

Updated

2024-08-04T12:32:14.323Z

Stack: node

Check your server →