CVE-2020-15156 XSS due to lack of CSRF validation for replying/publishing
A logged-in user can be tricked into posting on their behalf due to missing CSRF validation in the NodeBB blog comments plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-15156?
CVE-2020-15156 is a medium-severity vulnerability in psychobunny nodebb-plugin-blog-comments, published on 26 Aug 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum. This is due to lack of CSRF validation.
Weakness: CWE-352
Which versions are affected by CVE-2020-15156?
2 open source packages ship an affected version, including nodebb-plugin-blog-comments. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nodebb-plugin-blog-comments npm | All versions | 0.7.0 |
nodebb-plugin-blog-comments npm | All versions | 0.7.0 |
Products include Nodebb Blog Comments.
How do I fix CVE-2020-15156?
Upgrade nodebb-plugin-blog-comments to 0.7.0 or later.
Is CVE-2020-15156 being exploited?
There is no known exploitation of CVE-2020-15156 in the wild and no public exploit code.
Sources
Also known as GHSA-43m5-c88r-cjvv.