CVE-2020-15149: Account takeover in NodeBB
NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a running NodeBB forum by sending a specially crafted socket.io call to the server. This could lead to a privilege escalation event due via an account takeover. As a workaround you may cherry-pick the following commit from the project's repository to your running instance of NodeBB: 16cee1b03ba3eee177834a1fdac4aa8a12b39d2a. This is fixed in version 1.14.3.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-15149?
CVE-2020-15149 is a vulnerability in NodeBB before version 1.14.3 that allows an attacker to change the password of any user on a running NodeBB forum.
How does CVE-2020-15149 work?
CVE-2020-15149 works by exploiting a bug in the validation logic of NodeBB, allowing an attacker to send a specially crafted socket.io call to the server and change the password of any user.
What is the severity of CVE-2020-15149?
The severity of CVE-2020-15149 is critical with a CVSS score of 9.9.
Which software versions are affected by CVE-2020-15149?
NodeBB versions from 1.12.2 to 1.14.3 are affected by CVE-2020-15149.
How can CVE-2020-15149 be fixed?
To fix CVE-2020-15149, upgrade NodeBB to version 1.14.3 or later.