{"containers": {"cna": {"affected": [{"product": "NodeBB", "vendor": "NodeBB", "versions": [{"status": "affected", "version": ">=12.2.2, < 1.14.3"}]}], "descriptions": [{"lang": "en", "value": "NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a running NodeBB forum by sending a specially crafted socket.io call to the server. This could lead to a privilege escalation event due via an account takeover. As a workaround you may cherry-pick the following commit from the project's repository to your running instance of NodeBB: 16cee1b03ba3eee177834a1fdac4aa8a12b39d2a. This is fixed in version 1.14.3."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "description": "{\"CWE-269\":\"Improper Privilege Management\"}", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-10-14T21:06:16", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hr66-c8pg-5mg7"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/NodeBB/NodeBB/commit/c2477d9d5ffc43e5ffeb537ea2ceb4ce9592aa39"}, {"tags": ["x_refsource_MISC"], "url": "https://zeroauth.ltd/blog/2020/08/20/proof-of-concept-exploit-for-cve-2020-15149-nodebb-arbitrary-user-password-change/"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/159560/NodeBB-Forum-1.14.2-Account-Takeover.html"}], "source": {"advisory": "GHSA-hr66-c8pg-5mg7", "discovery": "UNKNOWN"}, "title": "Account takeover in NodeBB", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2020-15149", "STATE": "PUBLIC", "TITLE": "Account takeover in NodeBB"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "NodeBB", "version": {"version_data": [{"version_value": ">=12.2.2, < 1.14.3"}]}}]}, "vendor_name": "NodeBB"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a running NodeBB forum by sending a specially crafted socket.io call to the server. This could lead to a privilege escalation event due via an account takeover. As a workaround you may cherry-pick the following commit from the project's repository to your running instance of NodeBB: 16cee1b03ba3eee177834a1fdac4aa8a12b39d2a. This is fixed in version 1.14.3."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "{\"CWE-269\":\"Improper Privilege Management\"}"}]}]}, "references": {"reference_data": [{"name": "https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hr66-c8pg-5mg7", "refsource": "CONFIRM", "url": "https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hr66-c8pg-5mg7"}, {"name": "https://github.com/NodeBB/NodeBB/commit/c2477d9d5ffc43e5ffeb537ea2ceb4ce9592aa39", "refsource": "MISC", "url": "https://github.com/NodeBB/NodeBB/commit/c2477d9d5ffc43e5ffeb537ea2ceb4ce9592aa39"}, {"name": "https://zeroauth.ltd/blog/2020/08/20/proof-of-concept-exploit-for-cve-2020-15149-nodebb-arbitrary-user-password-change/", "refsource": "MISC", "url": "https://zeroauth.ltd/blog/2020/08/20/proof-of-concept-exploit-for-cve-2020-15149-nodebb-arbitrary-user-password-change/"}, {"name": "http://packetstormsecurity.com/files/159560/NodeBB-Forum-1.14.2-Account-Takeover.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/159560/NodeBB-Forum-1.14.2-Account-Takeover.html"}]}, "source": {"advisory": "GHSA-hr66-c8pg-5mg7", "discovery": "UNKNOWN"}}}}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2020-15149", "datePublished": "2020-08-19T17:50:12", "dateReserved": "2020-06-25T00:00:00", "dateUpdated": "2020-10-14T21:06:16", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nodebb:nodebb:*:*:*:*:*:*:*:*", "matchCriteriaId": "1A40F1AF-6D61-48FD-84F1-68578FF119C1", "versionEndExcluding": "1.14.3", "versionStartIncluding": "1.12.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a running NodeBB forum by sending a specially crafted socket.io call to the server. This could lead to a privilege escalation event due via an account takeover. As a workaround you may cherry-pick the following commit from the project's repository to your running instance of NodeBB: 16cee1b03ba3eee177834a1fdac4aa8a12b39d2a. This is fixed in version 1.14.3."}, {"lang": "es", "value": "NodeBB versiones anteriores a 1.14.3, presenta un error introducido en la versi\u00f3n 1.12.2 en la l\u00f3gica de comprobaci\u00f3n que hace posible cambiar la contrase\u00f1a de cualquier usuario en un foro NodeBB en ejecuci\u00f3n mediante el env\u00edo de una llamada socket.io especialmente dise\u00f1ada al servidor. Esto podr\u00eda conllevar a un evento de escalada de privilegios debido a una toma de control de la cuenta. Como soluci\u00f3n alternativa, puede seleccionar la siguiente confirmaci\u00f3n del repositorio del proyecto en su instancia en ejecuci\u00f3n de NodeBB: 16cee1b03ba3eee177834a1fdac4aa8a12b39d2a. Esto es corregido en la versi\u00f3n 1.14.3."}], "id": "CVE-2020-15149", "lastModified": "2021-11-18T18:34:43.587", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2020-08-20T01:17:12.337", "references": [{"source": "security-advisories@github.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/159560/NodeBB-Forum-1.14.2-Account-Takeover.html"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/NodeBB/NodeBB/commit/c2477d9d5ffc43e5ffeb537ea2ceb4ce9592aa39"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hr66-c8pg-5mg7"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://zeroauth.ltd/blog/2020/08/20/proof-of-concept-exploit-for-cve-2020-15149-nodebb-arbitrary-user-password-change/"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-269"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}