Lucene search

[email protected]CVE-2021-43787

HistoryNov 29, 2021 - 8:15 p.m.

CVE-2021-43787

2021-11-2920:15:08

CWE-1321

CWE-79

[email protected]

web.nvd.nist.gov

nodebb

node.js

forum software

vulnerability

prototype pollution

patch

v1.18.5

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.5%

JSON

Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.

Affected configurations

Vulners

NVD

Node

nodebbnodebbRange1.15.5–1.18.5

VendorProductVersionCPE
nodebbnodebb*cpe:2.3:a:nodebb:nodebb:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nodebb	nodebb	*	cpe:2.3:a:nodebb:nodebb::::::::

CNA Affected

[
  {
    "product": "NodeBB",
    "vendor": "NodeBB",
    "versions": [
      {
        "status": "affected",
        "version": ">= 1.15.5, < 1.18.5"
      }
    ]
  }
]