CVE-2022-3978: NodeBB abort cross-site request forgery
A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7. This affects an unknown part of the file /register/abort. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 2.5.8 is able to address this issue. The name of the patch is 2f9d8c350e54543f608d3d4c8e1a49bbb6cdea38. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-213555.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NodeBBto a version that resolves this vulnerability.Fixed in 2.5.8Patch 2f9d8c350e54543f608d3d4c8e1a49bbb6cdea38 - Compensating control
If you cannot immediately upgrade, mitigate the remotely exploitable CSRF issue in NodeBB (e.g., temporarily reduce exposure of NodeBB endpoints such as /register/abort to untrusted networks via network controls/ACLs) while you plan the upgrade.
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-3978.
What is the severity of CVE-2022-3978?
The severity of CVE-2022-3978 is medium (4.3).
Which software versions are affected by CVE-2022-3978?
NodeBB versions up to 2.5.7 are affected by CVE-2022-3978.
What is the impact of CVE-2022-3978?
CVE-2022-3978 allows for cross-site request forgery and can be exploited remotely.
How can CVE-2022-3978 be fixed?
Upgrading to version 2.5.8 of NodeBB will address CVE-2022-3978.