CVE-2022-3978 - CVE House

Back to Database

Status published Medium CVE-2022-3978

NodeBB abort cross-site request forgery

4.3 CVSS

Vulnerability Description

A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7. This affects an unknown part of the file /register/abort. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 2.5.8 is able to address this issue. The name of the patch is 2f9d8c350e54543f608d3d4c8e1a49bbb6cdea38. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-213555.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-3978

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from unspecified

View All →

tatoeba2 Profile Name cross site scripting

pig-vector LogisticRegression.java LogisticRegression temp file

sslh Packet Dumping probe.c hexdump format string

collective.contact.widget widgets.py title cross site scripting

WP-Ban ban-options.php cross site scripting

Affected Vendor

unspecified

View all reports →

Affected Software

NodeBB

Vulnerable Versions:

2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.5.4, 2.5.5, 2.5.6, 2.5.7

Timeline

Official Publish: November 13th, 2022

Last Modified: April 15th, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1078 Valid Accounts

T1548 Abuse Elevation Control Mechanism

Privilege Escalation

T1021 Remote Services

Lateral Movement

T1098 Account Manipulation

Defense Evasion