Описание
In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum. This is due to lack of CSRF validation.
Ссылки
- PatchThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- PatchThird Party Advisory
- Third Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 0.7.0 (исключая)
cpe:2.3:a:nodebb:blog_comments:*:*:*:*:*:node.js:*:*
EPSS
Процентиль: 43%
0.00206
Низкий
6.8 Medium
CVSS3
8.1 High
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-352
Связанные уязвимости
CVSS3: 6.8
github
больше 5 лет назад
XSS due to lack of CSRF validation for replying/publishing
EPSS
Процентиль: 43%
0.00206
Низкий
6.8 Medium
CVSS3
8.1 High
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-352