CVE-2021-43786

Published: Nov 29, 2021Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed master token access to the API. The vulnerability has been patch as of v1.18.5. Users are advised to upgrade as soon as possible.

Affected (1)

Products: Nodebb: Nodebb

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nodebb Nodebb	From 1.15.0 to 1.18.4

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (8)

https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/

Source: security-advisories@github.com

ExploitThird Party Advisory

https://github.com/NodeBB/NodeBB/commit/04dab1d550cdebf4c1567bca9a51f8b9ca48a500

Source: security-advisories@github.com

PatchThird Party Advisory

https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5

Source: security-advisories@github.com

Release NotesThird Party Advisory

https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hf2m-j98r-4fqw

Source: security-advisories@github.com

Third Party Advisory

https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://github.com/NodeBB/NodeBB/commit/04dab1d550cdebf4c1567bca9a51f8b9ca48a500

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesThird Party Advisory

https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hf2m-j98r-4fqw

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.