PT-2008-6106 · Mybb · Mybb

Hanno Böck + 4 · Published 2008-11-04 · Updated 2008-11-05 · CVE-2008-4930

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MyBB versions 1.4.2

Description The issue arises from improper handling of uploaded files with nonstandard file types that contain HTML sequences, allowing remote attackers to cause these files to be processed as HTML. This could potentially be leveraged for cross-site scripting (XSS) and other attacks.

Recommendations For version 1.4.2, update to a version that properly handles file uploads and MIME types to prevent HTML sequences in uploaded files from being executed.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-4930

Affected Products

Mybb

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2008-4930 · Security Note
• http://openwall.com/lists/oss-security/2008/11/01/2 · Note
• http://archives.neohapsis.com/archives/bugtraq/2008-10/0203.html · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2008-10/0472.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4930 · Note