CRITICAL🇬🇧 English

CVE-2022-46164

CVSS 9.4v3.1pub. 2022-12-05upd. 2024-11-21

NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patched in version 2.6.1. Users are advised to upgrade. Users unable to upgrade may cherry-pick commit `48d143921753914da45926cca6370a92ed0c46b8` into their codebase to patch the exploit.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

  • Nodebb

    APP
    Nodebb
    < 2.6.1
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2023-43187CRITICAL9.8ten sam produkt

A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software pri...

CVE-2023-26045CRITICAL10.0ten sam produkt

NodeBB is Node.js based forum software. Starting in version 2.5.0 and prior to version 2.8.7, due to the use o...

CVE-2022-36045CRITICAL9.0ten sam produkt

NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It u...

CVE-2021-43787CRITICAL9.0ten sam produkt

Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerabilit...

CVE-2021-43786CRITICAL9.8ten sam produkt

Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the tok...