Vulnerability Details CVE-2021-43786
Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintentionally allowed master token access to the API. The vulnerability has been patch as of v1.18.5. Users are advised to upgrade as soon as possible.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 62.8%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 5.0
References
- https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/
- https://github.com/NodeBB/NodeBB/commit/04dab1d550cdebf4c1567bca9a51f8b9ca48a500
- https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5
- https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hf2m-j98r-4fqw
- https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/
- https://github.com/NodeBB/NodeBB/commit/04dab1d550cdebf4c1567bca9a51f8b9ca48a500
- https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5
- https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hf2m-j98r-4fqw
Products affected by CVE-2021-43786
-
cpe:2.3:a:nodebb:nodebb:1.15.0
-
cpe:2.3:a:nodebb:nodebb:1.15.1
-
cpe:2.3:a:nodebb:nodebb:1.15.2
-
cpe:2.3:a:nodebb:nodebb:1.15.3
-
cpe:2.3:a:nodebb:nodebb:1.15.4
-
cpe:2.3:a:nodebb:nodebb:1.15.5
-
cpe:2.3:a:nodebb:nodebb:1.16.0
-
cpe:2.3:a:nodebb:nodebb:1.16.1
-
cpe:2.3:a:nodebb:nodebb:1.16.2
-
cpe:2.3:a:nodebb:nodebb:1.17.0
-
cpe:2.3:a:nodebb:nodebb:1.17.1
-
cpe:2.3:a:nodebb:nodebb:1.18.4