PT-2009-2551 · Mybb · Mybb

Publicado 2009-08-25 · Atualizado 2025-09-26 · CVE-2008-7082

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MyBB versions 1.4.3

Description The issue allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism, potentially hijacking the authentication of moderators. This is achieved by stealing a sensitive token, my post key, which is included in URLs to "moderation.php" with specific actions: (1) mergeposts, (2) split, and (3) deleteposts. The token can be read from the HTTP Referer header.

Recommendations For MyBB version 1.4.3, consider restricting access to the moderation.php endpoint with the mergeposts, split, and deleteposts actions until a patch is available. As a temporary workaround, avoid using the my post key parameter in the affected API endpoint to minimize the risk of exploitation.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2008-7082

Produtos afetados

Mybb

Referências · 8

• https://exchange.xforce.ibmcloud.com/vulnerabilities/46885 · Nota
• http://osvdb.org/50275 · Nota
• http://securityfocus.com/archive/1/498630/100/0/threaded · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7082 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-7082 · Nota de Segurança
• http://secunia.com/advisories/32880 · Aviso do Fabricante
• http://securityfocus.com/bid/32467 · Nota
• https://t.me/cveNotify/136638 · Publicação no Telegram