Skip to main content

Nodebb CVE-2023-2850

MEDIUM
Missing Origin Validation in WebSockets (CWE-1385)
2023-07-25 report@snyk.io
Information Disclosure Nodebb
4.7
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.7 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Jul 25, 2023 - 12:15 nvd
MEDIUM 4.7

DescriptionNVD

NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user information to be extracted by attacker.

AnalysisAI

NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-1385. NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user information to be extracted by attacker. Affected products include: Nodebb.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Nodebb

View all
CVE-2023-43187 CRITICAL POC
9.8 Sep 27

A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.1
CVE-2026-58593 HIGH POC
8.7 Jul 01

Author spoofing in NodeBB's ActivityPub federation allows a remote federated actor to forge posts and private messages a
CVE-2022-36076 HIGH POC
7.5 Sep 02

NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Rated high sev
CVE-2021-43786 HIGH POC
7.5 Nov 29

Nodebb is an open source Node.js based forum software. Rated high severity (CVSS 7.5), this vulnerability is remotely ex
CVE-2021-43787 MEDIUM POC
6.1 Nov 29

Nodebb is an open source Node.js based forum software. Rated medium severity (CVSS 6.1), this vulnerability is remotely

CVE-2020-15149 CRITICAL
9.9 Aug 20

NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to ch
CVE-2023-26045 CRITICAL
9.8 Jul 24

NodeBB is Node.js based forum software. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,

CVE-2022-46164 CRITICAL POC
9.8 Dec 05

NodeBB is an open source Node.js based forum software. Rated critical severity (CVSS 9.8), this vulnerability is remotel
CVE-2022-36045 CRITICAL
9.8 Aug 31

NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Rated critical
CVE-2024-57041 MEDIUM POC
4.6 Jan 24

A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code

CVE-2021-43788 MEDIUM POC
5.0 Nov 29

Nodebb is an open source Node.js based forum software. Rated medium severity (CVSS 5.0), this vulnerability is remotely

CVE-2022-3978 MEDIUM POC
4.3 Nov 13

A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7. Rated medium severity (CVSS 4.3),

Same weakness CWE-1385 – Missing Origin Validation in WebSockets

View all
CVE-2025-24964 CRITICAL POC
9.6
CVE-2023-49805 HIGH POC
8.8
CVE-2025-54289 HIGH POC
8.1
CVE-2026-59804 HIGH POC
7.6
CVE-2025-68930 HIGH POC
7.1
CVE-2026-22689 MEDIUM POC
6.5
CVE-2024-23168 CRITICAL
9.8
CVE-2023-0957 CRITICAL
9.6

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2023-2850 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy