PT-2023-21737 · Mybb · Mybb

Dvz · Publicado 2023-05-22 · Atualizado 2024-03-06 · CVE-2023-28467

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.34

Description The issue concerns a cross-site scripting (XSS) flaw in the User CP module, specifically via the user email field. This allows for potential malicious script execution.

Recommendations For versions prior to 1.8.34, update to version 1.8.34 or later to resolve the issue. As a temporary workaround, consider restricting access to the User CP module until the update is applied.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BIT-MYBB-2023-28467

CVE-2023-28467

GHSA-3Q8X-9FH2-V646

Produtos afetados

Mybb

Referências · 9

• 🔥 https://github.com/ahmetaltuntas/CVE-2023-28467 · Exploit
• https://github.com/mybb/mybb/security/advisories/GHSA-3q8x-9fh2-v646 · Correção
• https://t.me/cybersecuritytechnologies/8720 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-28467 · Nota de Segurança
• https://t.me/cvenotify/50930 · Publicação no Telegram
• https://osv.dev/vulnerability/BIT-mybb-2023-28467 · Aviso do Fabricante
• https://t.me/cibsecurity/64563 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-28467 · Aviso do Fabricante
• https://mybb.com · Nota