PT-2008-6106 · Mybb · Mybb

Hanno Böck + 4 · Publicado 2008-11-04 · Atualizado 2008-11-05 · CVE-2008-4930

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MyBB versions 1.4.2

Description The issue arises from improper handling of uploaded files with nonstandard file types that contain HTML sequences, allowing remote attackers to cause these files to be processed as HTML. This could potentially be leveraged for cross-site scripting (XSS) and other attacks.

Recommendations For version 1.4.2, update to a version that properly handles file uploads and MIME types to prevent HTML sequences in uploaded files from being executed.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-4930

Produtos afetados

Mybb

Referências · 5

• http://openwall.com/lists/oss-security/2008/11/01/2 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2008-10/0203.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-4930 · Nota de Segurança
• http://archives.neohapsis.com/archives/fulldisclosure/2008-10/0472.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4930 · Nota