cve/2023/CVE-2023-2850.md

### [CVE-2023-2850](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2850)
![](https://img.shields.io/static/v1?label=Product&message=NodeBB&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%202.8.13%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-1385%20Missing%20Origin%20Validation%20in%20WebSockets&color=brighgreen)

### Description

NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows certain user information to be extracted by attacker.

### POC

#### Reference
- https://github.com/NodeBB/NodeBB/commit/51096ad2345fb1d1380bec0a447113489ef6c359

#### Github
No PoCs found on GitHub currently.