Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Account takeover via prototype vulnerability
Vulnerability Description
NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patched in version 2.6.1. Users are advised to upgrade. Users unable to upgrade may cherry-pick commit `48d143921753914da45926cca6370a92ed0c46b8` into their codebase to patch the exploit.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Vulnerability Type
初始化不恰当
Vulnerability Title
NodeBB 安全漏洞
Vulnerability Description
NodeBB是Design Create Play团队的一套使用Node.js（一套建立在Google V8 JavaScript引擎之上的网络应用平台）构建的论坛系统。 NodeBB 2.6.1之前版本存在安全漏洞，该漏洞源于在socket.io消息处理中使用了带有原型的普通对象，可以使用特制的有效载荷来冒充其他用户和接管帐户。
CVSS Information
N/A
Vulnerability Type
N/A