CVE-2023-2850 Unintentional leakage of private information via cross-origin websocket session hijacking
Attackers can hijack WebSocket connections to extract user information from NodeBB forums due to missing origin validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-2850?
CVE-2023-2850 is a medium-severity vulnerability in NodeBB, published on 25 Jul 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user information to be extracted by attacker.
Which versions are affected by CVE-2023-2850?
4 open source packages ship an affected version, including nodebb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nodebb npm | All versions | 2.8.13 |
nodebb npm | All versions | 2.8.13 |
nodebb npm | From 3.0.0 | 3.1.3 |
nodebb npm | From 3.0.0 | 3.1.3 |
Products include Nodebb Nodebb.
How do I fix CVE-2023-2850?
Upgrade nodebb to a fixed version for your release line: 2.8.13 or 3.1.3.
Is CVE-2023-2850 being exploited?
There is no known exploitation of CVE-2023-2850 in the wild and no public exploit code.
Other vulnerabilities in NodeBB
Sources
Also known as GHSA-4qcv-qf38-5j3j.