Vulnerabilities > CVE-2022-46164 - Unspecified vulnerability in Nodebb

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

nodebb

critical

NVD

Published: 2022-12-05

Updated: 2024-11-21

Summary

NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patched in version 2.6.1. Users are advised to upgrade. Users unable to upgrade may cherry-pick commit `48d143921753914da45926cca6370a92ed0c46b8` into their codebase to patch the exploit.

Vulnerable Configurations

Part	Description	Count
Application	Nodebb Nodebb Nodebb 0.0.3 Nodebb Nodebb 0.0.4 Nodebb Nodebb 0.0.5 Nodebb Nodebb 0.0.6 Nodebb Nodebb 0.0.7 Nodebb Nodebb 0.1.0 Nodebb Nodebb 0.1.1 Nodebb Nodebb 0.2.0 Nodebb Nodebb 0.2.1 Nodebb Nodebb 0.2.2 Nodebb Nodebb 0.3.0 Nodebb Nodebb 0.3.1 Nodebb Nodebb 0.3.2 Nodebb Nodebb 0.4.0 Nodebb Nodebb 0.4.1 Nodebb Nodebb 0.4.2 Nodebb Nodebb 0.4.3 Nodebb Nodebb 0.5.0 Nodebb Nodebb 0.5.1 Nodebb Nodebb 0.5.2 Nodebb Nodebb 0.5.3 Nodebb Nodebb 0.5.4 Nodebb Nodebb 0.5.5 Nodebb Nodebb 0.5.6 Nodebb Nodebb 0.5.7 Nodebb Nodebb 0.6.0 Nodebb Nodebb 0.6.1 Nodebb Nodebb 0.7.0 Nodebb Nodebb 0.7.1 Nodebb Nodebb 0.7.2 Nodebb Nodebb 0.7.3 Nodebb Nodebb 0.8.0 Nodebb Nodebb 0.8.1 Nodebb Nodebb 0.8.2 Nodebb Nodebb 0.9.0 Nodebb Nodebb 0.9.1 Nodebb Nodebb 0.9.2 Nodebb Nodebb 0.9.3 Nodebb Nodebb 0.9.4 Nodebb Nodebb 1.0.0 Nodebb Nodebb 1.0.1 Nodebb Nodebb 1.0.2 Nodebb Nodebb 1.0.3 Nodebb Nodebb 1.0.4 Nodebb Nodebb 1.1.0 Nodebb Nodebb 1.1.1 Nodebb Nodebb 1.1.2 Nodebb Nodebb 1.1.3 Nodebb Nodebb 1.2.0 Nodebb Nodebb 1.2.1 Nodebb Nodebb 1.2.2 Nodebb Nodebb 1.3.0 Nodebb Nodebb 1.4.0 Nodebb Nodebb 1.4.1 Nodebb Nodebb 1.4.2 Nodebb Nodebb 1.4.3 Nodebb Nodebb 1.4.4 Nodebb Nodebb 1.4.5 Nodebb Nodebb 1.4.6 Nodebb Nodebb 1.5.0 Nodebb Nodebb 1.5.1 Nodebb Nodebb 1.5.2 Nodebb Nodebb 1.5.3 Nodebb Nodebb 1.6.0 Nodebb Nodebb 1.6.1 Nodebb Nodebb 1.7.0 Nodebb Nodebb 1.7.1 Nodebb Nodebb 1.7.2 Nodebb Nodebb 1.7.3 Nodebb Nodebb 1.7.4 Nodebb Nodebb 1.7.5 Nodebb Nodebb 1.8.0 Nodebb Nodebb 1.8.1 Nodebb Nodebb 1.8.2 Nodebb Nodebb 1.9.0 Nodebb Nodebb 1.9.1 Nodebb Nodebb 1.9.2 Nodebb Nodebb 1.9.3 Nodebb Nodebb 1.12.2 Nodebb Nodebb 1.13.0 Nodebb Nodebb 1.13.1 Nodebb Nodebb 1.13.2 Nodebb Nodebb 1.13.3 Nodebb Nodebb 1.13.4 Nodebb Nodebb 1.14.0 Nodebb Nodebb 1.14.1 Nodebb Nodebb 1.14.2 Nodebb Nodebb 1.14.3 Nodebb Nodebb 1.15.0 Nodebb Nodebb 1.15.1 Nodebb Nodebb 1.15.2 Nodebb Nodebb 1.15.3 Nodebb Nodebb 1.15.4 Nodebb Nodebb 1.15.5 Nodebb Nodebb 1.16.0 Nodebb Nodebb 1.16.1 Nodebb Nodebb 1.16.2 Nodebb Nodebb 1.17.0 Nodebb Nodebb 1.17.1 Nodebb Nodebb 1.18.4 Nodebb Nodebb 1.18.5 Nodebb Nodebb 1.18.6 Nodebb Nodebb 1.18.7 Nodebb Nodebb 1.19.0 Nodebb Nodebb 1.19.1 Nodebb Nodebb 1.19.3 Nodebb Nodebb 1.19.4 Nodebb Nodebb 1.19.5 Nodebb Nodebb 1.19.6 Nodebb Nodebb 1.19.7 Nodebb Nodebb 1.19.8 Nodebb Nodebb 2.0.0 Nodebb Nodebb 2.0.1 Nodebb Nodebb 2.1.0 Nodebb Nodebb 2.1.1 Nodebb Nodebb 2.2.0 Nodebb Nodebb 2.2.1 Nodebb Nodebb 2.2.2 Nodebb Nodebb 2.2.3 Nodebb Nodebb 2.2.4 Nodebb Nodebb 2.2.5 Nodebb Nodebb 2.3.0 Nodebb Nodebb 2.3.1 Nodebb Nodebb 2.4.0 Nodebb Nodebb 2.4.1 Nodebb Nodebb 2.4.2 Nodebb Nodebb 2.4.3 Nodebb Nodebb 2.4.4 Nodebb Nodebb 2.4.5 Nodebb Nodebb 2.5.0 Nodebb Nodebb 2.5.1 Nodebb Nodebb 2.5.2 Nodebb Nodebb 2.5.3 Nodebb Nodebb 2.5.4 Nodebb Nodebb 2.5.5 Nodebb Nodebb 2.5.6 Nodebb Nodebb 2.5.7 Nodebb Nodebb 2.5.8 Nodebb Nodebb 2.6.0	290

Summary

Vulnerable Configurations

References