XSS via prototype pollution
CVE-2021-43787

9CRITICAL

Key Information:

Vendor

Nodebb

Status
Nodebb
Vendor
CVE Published:
29 November 2021

What is CVE-2021-43787?

Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.

Affected Version(s)

NodeBB >= 1.15.5, < 1.18.5

References

https://github.com/NodeBB/NodeBB/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/NodeBB/NodeBB/commit/1783f918bc19568f4...
x_refsource_MISC
https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5
x_refsource_MISC

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.