Nodebb is an open source Node.js based forum software. Prior to v1.18.5, a path traversal vulnerability was present that allowed users to access JSON files outside of the expected `languages/` directory. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.
References
| Link | Resource |
|---|---|
| https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/ | Exploit Third Party Advisory |
| https://github.com/NodeBB/NodeBB/commit/c8b2fc46dc698db687379106b3f01c71b80f495f | Patch Third Party Advisory |
| https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5 | Release Notes Third Party Advisory |
| https://github.com/NodeBB/NodeBB/security/advisories/GHSA-pfj7-2qfw-vwgm | Third Party Advisory |
Configurations
History
27 Oct 2022, 19:32
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot/ - Exploit, Third Party Advisory |
13 Sep 2022, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
30 Nov 2021, 14:26
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://github.com/NodeBB/NodeBB/releases/tag/v1.18.5 - Release Notes, Third Party Advisory | |
| References | (MISC) https://github.com/NodeBB/NodeBB/commit/c8b2fc46dc698db687379106b3f01c71b80f495f - Patch, Third Party Advisory | |
| References | (CONFIRM) https://github.com/NodeBB/NodeBB/security/advisories/GHSA-pfj7-2qfw-vwgm - Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 4.0
v3 : 5.0 |
| CPE | cpe:2.3:a:nodebb:nodebb:*:*:*:*:*:*:*:* |
29 Nov 2021, 20:20
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-11-29 20:15
Updated : 2024-02-04 22:08
NVD link : CVE-2021-43788
Mitre link : CVE-2021-43788
CVE.ORG link : CVE-2021-43788
JSON object : View
Products Affected
nodebb
- nodebb
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')