CVE-2020-15149

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a running NodeBB forum by sending a specially crafted socket.io call to the server. This could lead to a privilege escalation event due via an account takeover. As a workaround you may cherry-pick the following commit from the project's repository to your running instance of NodeBB: 16cee1b03ba3eee177834a1fdac4aa8a12b39d2a. This is fixed in version 1.14.3.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Weakness enumeration

CWE-269CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Aug 20, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-15157.8An elevation of privilege vulnerability exists when the Windows Telephony Server improperly handles memory. To exploit this vulnerability, aCVE-2020-151509.8There is a vulnerability in Paginator (Elixir/Hex package) which makes it susceptible to Remote Code Execution (RCE) attacks via input paramCVE-2020-151518.0OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases CVE-2020-151529.1ftp-srv is an npm package which is a modern and extensible FTP server designed to be simple yet configurable. In ftp-srv before versions 2.1CVE-2020-151539.8Ampache before version 4.2.2 allows unauthenticated users to perform SQL injection. Refer to the referenced GitHub Security Advisory for detCVE-2020-151547.3baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit thiCVE-2020-151557.3baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit thiCVE-2020-151568.1In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to postCVE-2020-151576.1In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container imaCVE-2020-151589.8In libIEC61850 before version 1.4.3, when a message with COTP message length field with value < 4 is received an integer underflow will happCVE-2020-151597.6baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as CVE-2020-15167.8An elevation of privilege vulnerability exists when the Windows Work Folders Service improperly handles memory. To exploit this vulnerabilit