Back to CVE Browser

CVE-2021-43786

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.0270%

EPSS Percentile25.97th

PublishedNov 29, 2021

Last ModifiedNov 21, 2024

Vulnerability Description

Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed master token access to the API. The vulnerability has been patch as of v1.18.5. Users are advised to upgrade as soon as possible.

Affected Platforms (CPE)

📦

Nodebb

Nodebb

>= 1.15.0 and <= 1.18.4

References & Advisories

🔗 https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/

🔗 https://github.com/NodeBB/NodeBB/commit/04dab1d550cdebf4c1567bca9a51f8b9ca48a500

🔗 https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5

🔗 https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hf2m-j98r-4fqw

🔗 https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/

🔗 https://github.com/NodeBB/NodeBB/commit/04dab1d550cdebf4c1567bca9a51f8b9ca48a500

🔗 https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5

🔗 https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hf2m-j98r-4fqw

Related Vulnerabilities

CVE-2020-151499.9

NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the p...

CVE-2021-437879.0

Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader mo...

CVE-2021-477467.5

NodeBB Plugin Emoji 3.2.1 contains an arbitrary file write vulnerability that allows administrative users to write files to arbitr...

CVE-2020-151566.8

In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third par...