CVE-2021-43787criticalCWE-1321CWE-79

CVE-2021-43787: falha crítica em NodeBB

XSS via prototype pollution

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar NodeBB+ Monitorar nodebb

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9epss 1.3%
Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Produtos afetados
NodeBB · NodeBB
CVEs relacionadas — NodeBB

No mesmo produto, das mais perigosas para as menos.

CVE-2022-46164CRITICALAccount takeover via prototype vulnerabilityEPSS 47.4%CVE-2021-43788MEDIUMPath traversal in translator module of NobeBBEPSS 25.8%CVE-2020-15149CRITICALAccount takeover in NodeBBEPSS 2.4%CVE-2021-43786CRITICALAPI token verification can be bypassedEPSS 2.4%CVE-2022-36045CRITICALAccount takeover via cryptographically weak PRNG in NodeBB ForumEPSS 1.3%CVE-2023-26045CRITICALNodeBB vulnerable to path traversal and code execution via prototype vulnerabilityEPSS 1.0%