CVE Tools
Sign in

CVE-2022-36045

Account takeover via cryptographically weak PRNG in NodeBB Forum

Published: Aug 31, 2022Updated: Nov 21, 2024 Sources: CVE List NVD GHSA BDUCWE-330
9.0CRITICAL
NVD MITRE
EPSS Score
1.1%
Top 39.2%
CISA KEV
Not in KEV
Exploits
No Known Exploits
Remediation
Patch Available
Self-Check
OpenVAS

Description

NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes web sockets for instant interactions and real-time notifications. `utils.generateUUID`, a helper function available in essentially all versions of NodeBB (as far back as v1.0.1 and potentially earlier) used a cryptographically insecure Pseudo-random number generator (`Math.random()`), which meant that a specially crafted script combined with multiple invocations of the password reset functionality could enable an attacker to correctly calculate the reset code for an account they do not have access to. This vulnerability impacts all installations of NodeBB. The vulnerability allows for an attacker to take over any account without the involvement of the victim, and as such, the remediation should be applied immediately (either via NodeBB upgrade or cherry-pick of the specific changeset. The vulnerability has been patched in version 2.x and 1.19.x. There is no known workaround, but the patch sets listed above will fully patch the vulnerability.

No summary for this CVE yet.

CVSS Vector Breakdown

AV:NAC:HPR:NUI:NS:CC:HI:HA:H
Exploitability
AV:NAttack Vector
Network
AC:HAttack Complexity
High
PR:NPrivileges Required
None
UI:NUser Interaction
None
Scope
S:CScope
Changed
Impact
C:HConfidentiality
High
I:HIntegrity
High
A:HAvailability
High
Open in CVSS calculator →

Weaknesses

CWE-330CWE-338

Affected Products

NodeBB
commercialaka nodebb forum software
NodeBB ForumOn-prem
Web & CMS Plugins / forum-wiki
NodeBBOn-prem
Web & CMS Plugins / forum-wiki
npm
package-ecosystem
nodebb
OSS Libraries
and 1 more affected products View all →

Exploitability

Official Patch Available
Is your org exposed to CVE-2022-36045?We can run the check for you — a free external exposure review, no install. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

1 technique
Credential Access
View detailed technique mapping

References

https://github.com/NodeBB/NodeBB/commit/81e3c1ba488d03371a5ce8d0ebb5c5803026e0f9
github.com
https://github.com/NodeBB/NodeBB/commit/e802fab87f94a13f397f04cfe6068f2f7ddf7888
github.com
https://github.com/NodeBB/NodeBB/security/advisories/GHSA-p4cc-w597-6cpm
github.com
and 4 more references View all →

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2022-36045 and every CVE in our database. Create a free account — no credit card required.

Create Free Account
Plain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows