by Kastro
Paper/Archive/CVE-2021-43786

CVE-2021-43786

NodeBB NodeBB — API token verification can be bypassed

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 83.8.838 × 2016.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed master token access to the API. The vulnerability has been patch as of v1.18.5. Users are advised to upgrade as soon as possible.

Affected

ProductAffectedFixed inSource
NodeBB>= 1.15.0, < 1.18.5–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refgithub.com/NodeBB/NodeBB/releases/tag/v1.18.5refgithub.com/NodeBB/NodeBB/security/advisories/GHSA-hf2m-j98r-4fqwrefgithub.com/NodeBB/NodeBB/commit/04dab1d550cdebf4c1567bca9a51f8b9ca48a500refblog.sonarsource.com/nodebb-remote-code-execution-with-one-shot