This security bulletin contains one medium risk vulnerability.
The vulnerability allows a remote authenticated user to manipulate data.
Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any sanitation. By sending a specially crafted request, an attacker could exploit this vulnerability to update the email template for both password reset and account confirmation emails.Mitigation
Install update from vendor's website.Vulnerable software versions
strapi: 3.0.0 - 3.0.1Fixed software versions
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?