Improper Access Control in NodeBB 3.6.7 by NodeBB
CVE-2024-29316

6.3MEDIUM

Key Information:

Vendor

NodeBB

Status
NodeBB
Vendor
CVE Published:
28 March 2024

What is CVE-2024-29316?

NodeBB version 3.6.7 exhibits a vulnerability due to improper access control measures. This flaw allows low-privileged attackers to access restricted administrative tabs by exploiting the 'isadmin' property, enabling unauthorized actions within the platform. Such vulnerabilities can lead to significant risks, including unauthorized data exposure and manipulation.

References

https://nodebb.org/bounty/
https://medium.com/%40krityamkarma858041/broken-access-co...

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.