p PatchFirst

CVE-2023-2850

CVE-2023-2850

This page contains facts from public vulnerability sources. Check the original advisory before updating.

NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user information to be extracted by attacker.

CVSS 4.7 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • nodebb

    Versions
    • < 2.8.13: Affected
    • >= 3.0.0, < 3.1.3: Affected

    No fix published

  • nodebb npm

    Affected ranges
    • SEMVER: ≥ 3.0.0, < 3.1.3

    Update to 3.1.3

  • nodebb npm

    Affected ranges
    • SEMVER: < 2.8.13

    Update to 2.8.13

Original sources

Check your server →