PT-2010-5592 · Mybb · Mybb

Hanno Böck · Published 2010-12-30 · Updated 2017-08-17 · CVE-2010-4628

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.4.12

Description The issue allows remote attackers to cause a denial of service by consuming resources, triggered by making requests to "member.php" that result in scans of the entire users table. This is due to a superfluous call to the SQL COUNT function.

Recommendations For versions prior to 1.4.12, update to version 1.4.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the "member.php" file to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2010-4628

Affected Products

Mybb

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2010-4628 · Security Note
• http://blog.mybb.com/2010/04/13/mybb-1-4-12-released-security-maintenance-update · Vendor Advisory
• http://dev.mybboard.net/issues/662 · Note
• http://openwall.com/lists/oss-security/2010/10/11/8 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64514 · Note
• http://openwall.com/lists/oss-security/2010/12/06/2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4628 · Note
• http://openwall.com/lists/oss-security/2010/10/08/7 · Note