CVE-2023-2850

NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user information to be extracted by attacker.

Score

CVSS 3.1 4.7 Medium

Status

Modified - report@snyk.io

Published

2023-07-25

Last modified

2024-10-15

Weaknesses

CWE-1385, CWE-346

Affected products

• Nodebb (Nodebb)

References

• https://github.com/NodeBB/NodeBB/commit/51096ad2345fb1d1380bec0a447113489ef6c359
• https://github.com/NodeBB/NodeBB/releases/tag/v3.1.3
• https://github.com/NodeBB/NodeBB/security/advisories/GHSA-4qcv-qf38-5j3j