CVE-2021-43787

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report. The vulnerability has been patched as of v1.18.5. Users are advised to upgrade as soon as possible.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-1321

Affected software

No affected versions have been published.

Timeline

Published: Nov 29, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-437885.0Nodebb is an open source Node.js based forum software. Prior to v1.18.5, a path traversal vulnerability was present that allowed users to ac CVE-2021-437899.8PrestaShop is an Open Source e-commerce web application. Versions of PrestaShop prior to 1.7.8.2 are vulnerable to blind SQL injection using CVE-2021-43796.5The WooCommerce Multi Currency plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wmc_bulk_CVE-2021-437908.1Lucet is a native WebAssembly compiler and runtime. There is a bug in the main branch of `lucet-runtime` affecting all versions published to CVE-2021-437915.3Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected versions expiration dat CVE-2021-437924.3Discourse is an open source discussion platform. In affected versions a vulnerability affects users of tag groups who use the "Tags are visi CVE-2021-437934.3Discourse is an open source discussion platform. In affected versions a vulnerability in the Polls feature allowed users to vote multiple ti CVE-2021-437945.3Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous (i.e. not logged in) us CVE-2021-437957.5Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond i CVE-2021-437976.5Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers CVE-2021-437987.5Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions CVE-2021-437999.8Zulip is an open-source team collaboration tool. Zulip Server installs RabbitMQ for internal message passing. In versions of Zulip Server pr