CRITICAL🇵🇱 Wersja polska

CVE-2022-46164

CVSS 9.4v3.1pub. 2022-12-05upd. 2024-11-21

NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patched in version 2.6.1. Users are advised to upgrade. Users unable to upgrade may cherry-pick commit `48d143921753914da45926cca6370a92ed0c46b8` into their codebase to patch the exploit.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

  • Nodebb

    APP
    Nodebb
    < 2.6.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2023-43187CRITICAL9.8PL ✓same product

RCE w NodeBB via endpoint xmlrpc.php — wykonanie dowolnego kodu

CVE-2023-26045CRITICAL10.0PL ✓same product

NodeBB: path traversal umożliwiający zdalne wykonanie kodu JavaScript

CVE-2022-36045CRITICAL9.0PL ✓same product

NodeBB: przejęcie konta przez przewidywalny token resetu hasła

CVE-2021-43787CRITICAL9.0PL ✓same product

NodeBB: prototype pollution i XSS w module uploader umożliwiające przejęcie konta

CVE-2021-43786CRITICAL9.8PL ✓same product

NodeBB — pominięcie uwierzytelnienia w weryfikacji tokenów API (Auth Bypass)