CVE-2020-13961: Improper Input Validation

June 19, 2020 (updated June 24, 2020)

Strapi could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any sanitation. By sending a specially crafted request, an attacker could exploit this vulnerability to update the email template for both password reset and account confirmation emails.

References

exchange.xforce.ibmcloud.com/vulnerabilities/183045
nvd.nist.gov/vuln/detail/CVE-2020-13961

Code Behaviors & Features

Detect and mitigate CVE-2020-13961 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →