CVE-2020-15156: XSS due to lack of CSRF validation for replying/publishing
Published Aug 26, 2020
·Updated
In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum. This is due to lack of CSRF validation.
Affected Software
1 affected component
nodebb Blog Comments Node.js<0.7.0
Remediation
Event History
Aug 26, 2020
CVE Published
via MITRE·07:10 PM
Data Sourced
via MITRE·07:10 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2020-15156?
CVE-2020-15156 refers to a vulnerability in nodebb-plugin-blog-comments before version 0.7.0 that allows for an XSS attack for logged-in users.
2
How severe is CVE-2020-15156?
CVE-2020-15156 has a severity rating of 8.1 (high).
3
What is the affected software related to CVE-2020-15156?
The affected software for CVE-2020-15156 is Nodebb Blog Comments before version 0.7.0.
4
What is the root cause of CVE-2020-15156?
The root cause of CVE-2020-15156 is the lack of CSRF validation, leaving logged-in users vulnerable to XSS attacks.
5
How can I fix CVE-2020-15156?
To fix CVE-2020-15156, users are advised to update nodebb-plugin-blog-comments to at least version 0.7.0 to mitigate the XSS vulnerability.