Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
XSS due to lack of CSRF validation for replying/publishing
Vulnerability Description
In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum. This is due to lack of CSRF validation.
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Vulnerability Type
跨站请求伪造(CSRF)
Vulnerability Title
nodebb-plugin-blog-comments 跨站请求伪造漏洞
Vulnerability Description
nodebb-plugin-blog-comments 0.7.0之前版本存在跨站请求伪造漏洞，该漏洞源于登录的用户容易受到攻击，该攻击可能允许第三方代表他们在论坛上发布。这是由于缺少CSRF验证。
CVSS Information
N/A
Vulnerability Type
N/A