← Voltar para CVEs

CVE-2023-26045

CRITICAL

10.0

Descricao

NodeBB is Node.js based forum software. Starting in version 2.5.0 and prior to version 2.8.7, due to the use of the object destructuring assignment syntax in the user export code path, combined with a path traversal vulnerability, a specially crafted payload could invoke the user export logic to arbitrarily execute javascript files on the local disk. This issue is patched in version 2.8.7. As a workaround, site maintainers can cherry pick the fix into their codebase to patch the exploit.

Detalhes CVE

Pontuacao CVSS v3.110.0

SeveridadeCRITICAL

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado7/24/2023

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

nodebb:nodebb

Fraquezas (CWE)

CWE-22

Referencias

https://github.com/NodeBB/NodeBB/commit/ec58700f6dff8e5b4af1544f6205ec362b593092(security-advisories@github.com)

https://github.com/NodeBB/NodeBB/security/advisories/GHSA-vh2g-6c4x-5hmp(security-advisories@github.com)

https://security.netapp.com/advisory/ntap-20230831-0004/(security-advisories@github.com)

https://github.com/NodeBB/NodeBB/commit/ec58700f6dff8e5b4af1544f6205ec362b593092(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/NodeBB/NodeBB/security/advisories/GHSA-vh2g-6c4x-5hmp(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20230831-0004/(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.