PT-2018-13106 · Mybb · Mybb

0Xb9 · Publicado 2018-08-28 · Atualizado 2018-11-08 · CVE-2018-15596

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MyBB version 1.8.17

Description An issue was discovered in the forum RSS Syndication page, where thread titles within title elements of the generated XML documents aren't sanitized, leading to XSS. This can be exploited by generating a URL such as http://localhost/syndication.php?fid=&type=atom1.0&limit=15.

Recommendations For MyBB version 1.8.17, update to a newer version that addresses this issue, as the current version allows for XSS attacks due to unsanitized thread titles in the RSS Syndication page.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-15596

Produtos afetados

Mybb

Referências · 4

• 🔥 https://exploit-db.com/exploits/45393 · Exploit
• https://osv.dev/vulnerability/CVE-2018-15596 · Aviso do Fabricante
• https://blog.mybb.com/2018/08/22/mybb-1-8-18-released-security-maintenance-release · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-15596 · Nota de Segurança