CVE-2023-43187

high-risk
Published 2023-09-27

A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests.

Do I need to act?

!
90.1% chance of exploitation in next 30 days
EPSS score — higher than 10% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
+
Fix available
Upgrade to: 22e74dc0bb9cf296f548ad3b67ba1d297e4a7dc1
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Nodebb

Affected Vendors

Nodebb

References (2)

Exploit https://github.com/jagat-singh-chaudhary/CVE/blob/main/CVE-2023-43187
Exploit https://github.com/jagat-singh-chaudhary/CVE/blob/main/CVE-2023-43187
57
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 20/34 · Moderate
Exposure 5/34 · Minimal