CVE-2023-43187
CVE-2023-43187 is a critical-severity vulnerability in Nodebb with a CVSS 3.x base score of 9.8. Its EPSS exploit-prediction score of 45% places it in the 99th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-91.
Key facts
- Severity: Critical (CVSS 3.x base score 9.8)
- EPSS exploit prediction: 45% (99th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-91
- Affected product: Nodebb
- Published:
- Last modified:
Description
A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests.
Frequently asked questions
- What is CVE-2023-43187?
- A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests.
- How severe is CVE-2023-43187?
- CVE-2023-43187 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2023-43187 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 45% (99th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2023-43187?
- CVE-2023-43187 affects Nodebb. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2023-43187?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- When was CVE-2023-43187 published?
- CVE-2023-43187 was published on 2023-09-27 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:nodebb:nodebb:*:*:*:*:*:*:*:*
More vulnerabilities in Nodebb
- CVE-2023-26045 — Critical (CVSS 10.0): NodeBB is Node.js based forum software. Starting in version 2.5.0 and prior to version 2.8.7, due to the use of the…
- CVE-2020-15149 — Critical (CVSS 9.9): NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to…
- CVE-2021-43786 — Critical (CVSS 9.8): Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token…
- CVE-2022-46164 — Critical (CVSS 9.4): NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io…
- CVE-2022-36045 — Critical (CVSS 9.0): NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. It utilizes…
- CVE-2021-43787 — Critical (CVSS 9.0): Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the…
Other CWE-91 (XML Injection) vulnerabilities
- CVE-2021-4140 — Critical (CVSS 10.0): It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability…
- CVE-2019-19450 — Critical (CVSS 9.8): paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates…
- CVE-2021-37154 — Critical (CVSS 9.8): In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a…
- CVE-2020-29128 — Critical (CVSS 9.8): petl before 1.68, in some configurations, allows resolution of entities in an XML document.
- CVE-2020-25216 — Critical (CVSS 9.8): yWorks yEd Desktop before 3.20.1 allows code execution via an XSL Transformation when using an XML file in conjunction…
- CVE-2020-11535 — Critical (CVSS 9.8): An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit…