CRITICAL🇵🇱 Wersja polska

CVE-2021-43786

CVSS 9.8v3.1pub. 2021-11-29upd. 2024-11-21

Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed master token access to the API. The vulnerability has been patch as of v1.18.5. Users are advised to upgrade as soon as possible.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Nodebb

    APP
    Nodebb
    1.15.0 – 1.18.4
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2023-43187CRITICAL9.8PL ✓same product

RCE w NodeBB via endpoint xmlrpc.php — wykonanie dowolnego kodu

CVE-2023-26045CRITICAL10.0PL ✓same product

NodeBB: path traversal umożliwiający zdalne wykonanie kodu JavaScript

CVE-2022-46164CRITICAL9.4PL ✓same product

NodeBB — przejęcie konta przez prototype pollution w socket.io

CVE-2022-36045CRITICAL9.0PL ✓same product

NodeBB: przejęcie konta przez przewidywalny token resetu hasła

CVE-2021-43787CRITICAL9.0PL ✓same product

NodeBB: prototype pollution i XSS w module uploader umożliwiające przejęcie konta