Quick answers
- Is CVE-2024-29316 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-29316 being exploited in the wild.
- How severe is CVE-2024-29316?
- Low severity, with a CVSS score of 3.1, published 29 March 2024.
- Which products and versions are affected?
- NodeBB prior to 3.6.7.
- Is there a fix for CVE-2024-29316?
- A patch was published on 2024-03-28: Fix released in version 3.6.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2024-29316 attacked?
- It is attacked over the network.
- Am I affected by CVE-2024-29316?
- Check whether you run NodeBB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
NodeBB prior to version 3.6.7 contained an incorrect access control vulnerability (CWE-284) in the admin interface. The flaw allowed authenticated non-administrator users to access restricted tabs designated for administrator group members only. The vulnerability requires prior authentication to the platform but does not require elevated privileges. An attacker with a standard user account could bypass access controls to view and potentially interact with administrative interfaces, circumventing the intended role-based access control (RBAC). The issue has been fixed in NodeBB 3.6.7 and later versions.
Affected products
- NodeBB NodeBB prior to 3.6.7
Identifiers
- CVE-2024-29316
- GHSA-qc99-r4wh-c8h6
Timeline
- 2024-03-29: disclosed
- 2024-03-28: patched: Fix released in version 3.6.7