CRITICAL🇵🇱 Wersja polska

CVE-2021-43787

CVSS 9.0v3.1pub. 2021-11-29upd. 2024-11-21

Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

  • Nodebb

    APP
    Nodebb
    1.15.5 – 1.18.4
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Path TraversalXSS
CWE
References

Related vulnerabilities

CVE-2023-43187CRITICAL9.8PL ✓same product

RCE w NodeBB via endpoint xmlrpc.php — wykonanie dowolnego kodu

CVE-2023-26045CRITICAL10.0PL ✓same product

NodeBB: path traversal umożliwiający zdalne wykonanie kodu JavaScript

CVE-2022-46164CRITICAL9.4PL ✓same product

NodeBB — przejęcie konta przez prototype pollution w socket.io

CVE-2022-36045CRITICAL9.0PL ✓same product

NodeBB: przejęcie konta przez przewidywalny token resetu hasła

CVE-2021-43786CRITICAL9.8PL ✓same product

NodeBB — pominięcie uwierzytelnienia w weryfikacji tokenów API (Auth Bypass)