PT-2008-6105 · Mybb · Mybb

CVE-2008-4929 · Publicado 2008-11-04 · Atualizado 2025-01-17

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions MyBB versions 1.4.2

Description The issue is related to insufficient randomness used to compose filenames of uploaded files used as attachments. This makes it easier for remote attackers to read these files by guessing filenames.

Recommendations For MyBB version 1.4.2, consider implementing a more secure method to generate random filenames for uploaded attachments to prevent guessing of filenames by remote attackers.

Exploit

Correção

Use of Insufficiently Random Values

Enumeração de Fraquezas

CWE-330

Identificadores relacionados

CVE-2008-4929

Produtos afetados

Mybb

Referências · 8

• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2008-10/0472.html · Exploit
• 🔥 http://openwall.com/lists/oss-security/2008/11/01/2 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2008-10/0203.html · Exploit
• http://securityfocus.com/bid/31936 · Nota
• https://t.me/cvenotify/107780 · Publicação no Telegram
• http://vupen.com/english/advisories/2008/2967 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4929 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-4929 · Nota de Segurança