CVE-2023-2850 MEDIUM

CVE-2023-2850

Vendor Nodebb
Product NodeBB
Weakness CWE-1385
Published July 25, 2023
Last update October 15, 2024
View on NVD All CVEs

CVSS base score

4.7/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

What the vulnerability does

01Description

NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user information to be extracted by attacker.

Key dates

02Disclosure timeline

July 25, 2023 CVE published
October 15, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-54289 Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API CVE-2025-52882 Claude Code IDE extensions allow websocket connections from arbitrary origins CVE-2023-2886 Cross-Site WebSocket Hijacking in CBOT's Chatbot CVE-2026-44514 Kubetail: Cross-Site WebSocket Hijacking allows attacker to read Kubernetes logs from authenticated users CVE-2023-30856 eDEX-UI cross-site websocket hijacking vulnerability enables remote command execution