CVE-2020-15849

Re:Desk 2.3 contains a blind authenticated SQL injection in the SettingsController::actionEmailTemplates() method. A user with admin access could retrieve sensitive data, bypass authorization, and modify password-reset tokens, potentially leading to account takeovers. The issue could also enable ...