PT-2018-9400 · Mybb · Mybb

Riley Baird · Publicado 2018-06-26 · Atualizado 2019-10-03 · CVE-2018-1000502

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.15

Description The issue is related to a File Inclusion vulnerability in the Admin panel, specifically in the Task Manager section. This vulnerability can lead to Local File Inclusion on modern PHP versions and Remote File Inclusion on older PHP versions. The attack requires access to the admin panel.

Recommendations For versions prior to 1.8.15, update to version 1.8.15 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin panel, specifically the Task Manager section, to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-829

Identificadores relacionados

CVE-2018-1000502

Produtos afetados

Mybb

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-1000502 · Nota de Segurança
• https://blog.mybb.com/2018/03/15/mybb-1-8-15-released-security-maintenance-release · Aviso do Fabricante
• http://batterystapl.es/2018/03/local-file-inclusion-and-reading.html · Nota
• https://osv.dev/vulnerability/CVE-2018-1000502 · Aviso do Fabricante