Quick answers
- Is CVE-2022-36045 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2022-36045 being exploited in the wild.
- How severe is CVE-2022-36045?
- Low severity, with a CVSS score of 3.1, published 30 August 2022.
- Which products and versions are affected?
- NodeBB all versions up to and including 1.19.7 and 2.0.0.
- Is there a fix for CVE-2022-36045?
- A patch was published on 2022-08-30. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2022-36045 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2022-36045?
- Check whether you run NodeBB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the `utils.generateUUID` helper function used by NodeBB's password reset mechanism. The function relies on JavaScript's `Math.random()` for generating reset codes, which is not cryptographically secure and its output is predictable. An attacker can use multiple password reset requests combined with brute-force or prediction techniques to calculate valid reset tokens for target accounts. No prior authentication or user interaction is required; the attacker only needs to know or guess the target's email address. Patches are available in versions 1.19.8 and 2.0.1, which replace the weak PRNG with a cryptographically secure random number generator.
Affected products
- NodeBB NodeBB all versions up to and including 1.19.7 and 2.0.0
Identifiers
- CVE-2022-36045
- GHSA-p4cc-w597-6cpm
Timeline
- 2022-08-24: disclosed
- 2022-08-30: patched
- 2022-08-30: advisory