未評価
In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access...
CVE-2021-28128
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory strapi.io
- report syss.de