CVE-2024-29316

Description

In NodeBB prior to 3.6.7 an attacker was able to access the restricted tabs for the Admin group which are only allowed the the administrators.

How to fix CVE-2024-29316

To remediate CVE-2024-29316, upgrade the affected package to a fixed version below.

• npm/nodebb—upgrade to 3.6.7 or later

Is CVE-2024-29316 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 3.6.7

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-29316
• PATCHgithub.com/NodeBB/NodeBB
• WEBmedium.com/%40krityamkarma858041/broken-access-control-nodebb-v3-6-7-eebc59c24deb
• WEBnodebb.org/bounty