CVE-2020-15149 - CVE House
Back to Database
Status published Critical CVE-2020-15149

Account takeover in NodeBB

Vulnerability Description

NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a running NodeBB forum by sending a specially crafted socket.io call to the server. This could lead to a privilege escalation event due via an account takeover. As a workaround you may cherry-pick the following commit from the project's repository to your running instance of NodeBB: 16cee1b03ba3eee177834a1fdac4aa8a12b39d2a. This is fixed in version 1.14.3.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-15149

Credits & Attribution

No credits recorded in the NVD database.

References

More from NodeBB

View All →
CVE-2023-2850
NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due...
Medium 4.7
CVE-2023-26045
NodeBB vulnerable to path traversal and code execution via prototype vulnerability
Critical 10
CVE-2022-46164
Account takeover via prototype vulnerability
Critical 9.4
CVE-2022-36076
Account takeover via SSO plugins in NodeBB
High 8.8
CVE-2022-36045
Account takeover via cryptographically weak PRNG in NodeBB Forum
Critical 9

Affected Vendor

Affected Software

NodeBB
Vulnerable Versions:
>=12.2.2, < 1.14.3

Timeline

Official Publish: August 19th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Weaknesses (CWE)

CWE-269

MITRE ATT&CK TTPs

T1078 Valid Accounts
Persistence
T1098 Account Manipulation
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1222 File and Directory Permissions Modification
Defense Evasion
T1134 Access Token Manipulation
Defense Evasion