CVE-2023-2850: Origin Validation Error

July 25, 2023 (updated August 7, 2023)

NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user information to be extracted by attacker.

References

github.com/NodeBB/NodeBB/commit/51096ad2345fb1d1380bec0a447113489ef6c359
github.com/NodeBB/NodeBB/releases/tag/v3.1.3
github.com/NodeBB/NodeBB/security/advisories/GHSA-4qcv-qf38-5j3j
nvd.nist.gov/vuln/detail/CVE-2023-2850

Code Behaviors & Features

Detect and mitigate CVE-2023-2850 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →