GitHub Advisoryadvisory · npm
GHSA-43m5-c88r-cjvv XSS due to lack of CSRF validation for replying/publishing
MEDIUM
Official page ↗
- Aliases
- CVE-2020-15156
- Ecosystem
- npm
- Packages
- nodebb-plugin-blog-comments
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-352
- Reviewed
- 2020-08-26
Affected packages
• npm nodebb-plugin-blog-comments: < 0.7.0 → fixed in 0.7.0
Description
Impact
Due to lack of CSRF validation, a logged in user is potentially vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum.
Patches
Upgrade to the latest version v0.7.0
Workarounds
You can cherry-pick the following commit: https://github.com/psychobunny/nodebb-plugin-blog-comments/commit/cf43beedb05131937ef46f365ab0a0c6fa6ac618
References
Visit https://community.nodebb.org if you have any questions about this issue or on how to patch / upgrade your instance.
Related
Alias · CVE (1)
- CVE-2020-15156 In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to… vulnerability
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- https://github.com/psychobunny/nodebb-plugin-blog-comments/security/advisories/GHSA-43m5-c88r-cjvv web
- https://nvd.nist.gov/vuln/detail/CVE-2020-15156 advisory
- https://github.com/psychobunny/nodebb-plugin-blog-comments/commit/cf43beedb05131937ef46f365ab0a0c6fa6ac618 web
- https://www.npmjs.com/package/nodebb-plugin-blog-comments web