PT-2008-6105 · Mybb · Mybb

Published 2008-11-04 · Updated 2025-01-17 · CVE-2008-4929

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions MyBB versions 1.4.2

Description The issue is related to insufficient randomness used to compose filenames of uploaded files used as attachments. This makes it easier for remote attackers to read these files by guessing filenames.

Recommendations For MyBB version 1.4.2, consider implementing a more secure method to generate random filenames for uploaded attachments to prevent guessing of filenames by remote attackers.

Exploit

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2008-4929

Affected Products

Mybb

References · 8

• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2008-10/0472.html · Exploit
• 🔥 http://openwall.com/lists/oss-security/2008/11/01/2 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2008-10/0203.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4929 · Security Note
• http://securityfocus.com/bid/31936 · Note
• https://t.me/cvenotify/107780 · Telegram Post
• http://vupen.com/english/advisories/2008/2967 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4929 · Note