CVE-2021-43787 – nodebb

Package

Manager: npm
Name: nodebb
Vulnerable Version: >=1.15.0 <1.18.5

Severity

Level: Critical

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

EPSS: 0.00392 pctl0.59407

Details

XSS via prototype pollution in NodeBB ### Impact A prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report. ### Patches The vulnerability has been patched as of v1.18.5. ### Workarounds Cherry-pick commit hash 1783f918bc19568f421473824461ff2ed7755e4c to receive this patch in lieu of a full upgrade. ### For more information If you have any questions or comments about this advisory: * Email us at [security@nodebb.org](mailto:security@nodebb.org)

Metadata

Created: 2021-11-30T22:21:01Z
Modified: 2021-12-01T15:07:01Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-wx69-rvg3-x7fc/GHSA-wx69-rvg3-x7fc.json
CWE IDs: ["CWE-79"]
Alternative ID: GHSA-wx69-rvg3-x7fc
Finding: F008
Auto approve: 1