CVE Vulnerability

CVE-2022-46164

NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patched in version 2.6.1. Users are advised to upgrade. Users unable to upgrade may cherry-pick commit `48d143921753914da45926cca6370a92ed0c46b8` into their codebase to patch the exploit.

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/NodeBB/NodeBB/commit/48d143921753914da45926cca6370a92ed0c46b8 Patch Third Party Advisory
https://github.com/NodeBB/NodeBB/security/advisories/GHSA-rf3g-v8p5-p675 Patch Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:nodebb:nodebb:*:*:*:*:*:*:*:*
Information

Published : 2022-12-05 09:15

Updated : 2022-12-07 04:49

NVD link : CVE-2022-46164

Mitre link : CVE-2022-46164

Products Affected
No products.
CWE
CWE-665