Riskcovery

CVE-2022-3978

NodeBB abort cross-site request forgery

State
Published
Severity
4.3 Medium
Published
Nov 13, 2022
Updated
Apr 15, 2025
Reserved
Nov 13, 2022

Read the record on cve.org

Description

A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7. This affects an unknown part of the file /register/abort. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 2.5.8 is able to address this issue. The name of the patch is 2f9d8c350e54543f608d3d4c8e1a49bbb6cdea38. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-213555.

Scores

CVSSScoreVectorSource
3.14.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NVulDB

Weaknesses

  • CWE-863 Incorrect Authorization -> CWE-862 Missing Authorization -> CWE-352 Cross-Site Request Forgery

Affected Products

ProductVersions
NodeBBunspecified
  • 2.5.0Affected
  • 2.5.1Affected
  • 2.5.2Affected
  • 2.5.3Affected
  • 2.5.4Affected
  • 2.5.5Affected
  • 2.5.6Affected
  • 2.5.7Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.