CVE-2022-36076

HIGH
Published Sep 2, 20223y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Sep 2, 2022 3y ago
Last Modified Jun 17, 2026 2w ago

Description

NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict conditional in the code handling the first step of the SSO process, the pre-existing logic that added (and later checked) a nonce was inadvertently rendered opt-in instead of opt-out. This re-exposed a vulnerability in that a specially crafted Man-in-the-Middle (MITM) attack could theoretically take over another user account during the single sign-on process. The issue has been fully patched in version 1.17.2.

CVSS Details

Base Score
7.5
Exploitability
1.6
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-352 Cross-Site Request Forgery (CSRF) Authentication

Affected Products 1

VendorProductVersionRange
nodebbnodebb* <1.17.2

References 3

  • blogs.opera.com https://blogs.opera.com/security/2022/03/bug-bounty-adventures-a-nodebb-0-day/
    ExploitThird Party Advisory
  • github.com https://github.com/NodeBB/NodeBB/commit/a2400f6baff44cb2996487bcd0cc6e2acc74b3d4
    PatchThird Party Advisory
  • github.com https://github.com/NodeBB/NodeBB/security/advisories/GHSA-xmgg-fx9p-prq6
    ExploitPatchThird Party Advisory

Remediation

  • github.com https://github.com/NodeBB/NodeBB/commit/a2400f6baff44cb2996487bcd0cc6e2acc74b3d4
    PatchThird Party Advisory
  • github.com https://github.com/NodeBB/NodeBB/security/advisories/GHSA-xmgg-fx9p-prq6
    ExploitPatchThird Party Advisory