CVE-2020-15149

NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a running NodeBB forum by sending a specially crafted socket.io call to the server. This could lead to a privilege escalation event due via an...

PT-2020-14227

Name of the Vulnerable Software and Affected Versions NodeBB versions 1.12.2 through 1.14.2 Description The issue is related to a bug in the validation logic of NodeBB, which allows an attacker to change the password of any user by sending a specially crafted socket.io call to the server. This...

CVE-2020-15149: Improper Privilege Management

NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a running NodeBB forum by sending a specially crafted socket.io call to the server. This could lead to a privilege escalation event due via an...