Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:HNodebb
APPNodebb1.15.5 – 1.18.4
Related vulnerabilities
A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software pri...
NodeBB is Node.js based forum software. Starting in version 2.5.0 and prior to version 2.8.7, due to the use o...
NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in so...
NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It u...
Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the tok...