PT-2019-12765 · Mybb+1 · Mybb+1

Mohamed A. Baset · Publicado 2019-07-11 · Atualizado 2019-07-17 · CVE-2019-12363

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB

Description A CSRF issue allows an attacker to forge a request to control the state of the mybb2fa plugin via "usercp.php?action=mybb2fa&do=deactivate" or "usercp.php?action=mybb2fa&do=activate" API endpoints, specifically by manipulating the do parameter. This can lower the security of the targeted account by disabling two-factor authentication.

Recommendations For JN-Jones MyBB-2FA plugin through 2014-11-05, consider disabling the mybb2fa plugin until a patch is available to prevent exploitation. Restrict access to the "usercp.php?action=mybb2fa&do=deactivate" and "usercp.php?action=mybb2fa&do=activate" API endpoints to minimize the risk of exploitation.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2019-12363

Produtos afetados

Mybb

Mybb-2Fa Plugin

Referências · 4

• 🔥 https://seekurity.com/blog/advisories/mybb-two-factor-authentication-extension-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12363 · Nota de Segurança
• https://community.mybb.com/thread-162369.html · Nota
• https://osv.dev/vulnerability/CVE-2019-12363 · Aviso do Fabricante