CVE-2020-13961

Katalog CVE

CVSS 6.5 · Medium EPSS 1,7%

Kerentanan Improper Input Validation pada strapi. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any sanitation. By sending a specially crafted request, an attacker could exploit this vulnerability to update the email template for both password reset and account confirmation emails.

Rincian

Terbit di NVD

19 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 76,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://exchange.xforce.ibmcloud.com/vulnerabilities/183045 advisory pihak ketiga · vdb entry
• https://github.com/strapi/strapi/pull/6599 advisory pihak ketiga
• https://github.com/strapi/strapi/releases/tag/v3.0.2 release notes · advisory pihak ketiga