PT-2018-9400 · Mybb · Mybb

Riley Baird · Published 2018-06-26 · Updated 2019-10-03 · CVE-2018-1000502

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.15

Description The issue is related to a File Inclusion vulnerability in the Admin panel, specifically in the Task Manager section. This vulnerability can lead to Local File Inclusion on modern PHP versions and Remote File Inclusion on older PHP versions. The attack requires access to the admin panel.

Recommendations For versions prior to 1.8.15, update to version 1.8.15 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin panel, specifically the Task Manager section, to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2018-1000502

Affected Products

Mybb

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-1000502 · Security Note
• https://blog.mybb.com/2018/03/15/mybb-1-8-15-released-security-maintenance-release · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1000502 · Vendor Advisory
• http://batterystapl.es/2018/03/local-file-inclusion-and-reading.html · Note