CVE-2023-2850CWE-1385

NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin

Medium · published July 25, 2023

CVSS v3.1
4.7
EPSS
0%
Percentile
25.5
In the wild
Unconfirmed
What it is

NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user information to be extracted by attacker.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00333 · 25.5th percentile
Weakness
CWE-1385 · Missing Origin Validation in WebSockets
Published
2023-07-25T11:13Z
EPSS history
Timeline
  • 25 JUL 11:13Z
    NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin
    cvelistv5