PT-2010-5592 · Mybb · Mybb

Hanno Böck · Publicado 2010-12-30 · Atualizado 2017-08-17 · CVE-2010-4628

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.4.12

Description The issue allows remote attackers to cause a denial of service by consuming resources, triggered by making requests to "member.php" that result in scans of the entire users table. This is due to a superfluous call to the SQL COUNT function.

Recommendations For versions prior to 1.4.12, update to version 1.4.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the "member.php" file to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2010-4628

Produtos afetados

Mybb

Referências · 8

• http://dev.mybboard.net/issues/662 · Nota
• http://openwall.com/lists/oss-security/2010/10/11/8 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-4628 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64514 · Nota
• http://openwall.com/lists/oss-security/2010/12/06/2 · Nota
• http://blog.mybb.com/2010/04/13/mybb-1-4-12-released-security-maintenance-update · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4628 · Nota
• http://openwall.com/lists/oss-security/2010/10/08/7 · Nota