CVE-2020-15156 MEDIUM

CVE-2020-15156: XSS due to lack of CSRF validation for replying/publishing

Vendor Psychobunny
Product nodebb-plugin-blog-comments
Weakness CWE-352 · CSRF
Published August 26, 2020
Last update August 4, 2024
View on NVD All CVEs

CVSS base score

6.8/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum. This is due to lack of CSRF validation.

Key dates

02Disclosure timeline

August 26, 2020 CVE published
August 4, 2024 Record updated