CVE-2020-15156

Katalog CVE

CVSS 8.1 · High EPSS 0,61%

Kerentanan Cross-Site Request Forgery (CSRF) pada nodebb blog comments. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum. This is due to lack of CSRF validation.

Rincian

Terbit di NVD

26 Agustus 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 47,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/psychobunny/nodebb-plugin-blog-comments/commit/cf43beedb05131937ef46f365ab0a0c6fa6ac618 patch · advisory pihak ketiga
• https://github.com/psychobunny/nodebb-plugin-blog-comments/security/advisories/GHSA-43m5-c88r-cjvv advisory pihak ketiga
• https://www.npmjs.com/package/nodebb-plugin-blog-comments advisory pihak ketiga