PT-2018-10048 · Mybb+1 · Mybb+1

Mayur Udiniya · Published 2018-05-13 · Updated 2018-06-05 · CVE-2018-10678

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MyBB version 1.8.15

Description The issue concerns the mishandling of 'target=" blank" rel="noopener"' in A elements by MyBB 1.8.15 when accessed with Microsoft Edge. This makes it easier for remote attackers to conduct redirection attacks.

Recommendations For MyBB version 1.8.15, consider updating to a newer version that addresses this issue, as no specific fix is provided for this version.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2018-10678

Affected Products

Edge

Mybb

References · 4

• https://osv.dev/vulnerability/CVE-2018-10678 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-10678 · Security Note
• https://gist.github.com/MayurUdiniya/7aaa50b878d82b6aab6ed0b3e2b080bc · Note
• http://securityfocus.com/bid/104187 · Note