PT-2019-12765 · Mybb+1 · Mybb+1

Mohamed A. Baset · Published 2019-07-11 · Updated 2019-07-17 · CVE-2019-12363

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB

Description A CSRF issue allows an attacker to forge a request to control the state of the mybb2fa plugin via "usercp.php?action=mybb2fa&do=deactivate" or "usercp.php?action=mybb2fa&do=activate" API endpoints, specifically by manipulating the do parameter. This can lower the security of the targeted account by disabling two-factor authentication.

Recommendations For JN-Jones MyBB-2FA plugin through 2014-11-05, consider disabling the mybb2fa plugin until a patch is available to prevent exploitation. Restrict access to the "usercp.php?action=mybb2fa&do=deactivate" and "usercp.php?action=mybb2fa&do=activate" API endpoints to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-12363

Affected Products

Mybb

Mybb-2Fa Plugin

References · 4

• 🔥 https://seekurity.com/blog/advisories/mybb-two-factor-authentication-extension-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12363 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12363 · Vendor Advisory
• https://community.mybb.com/thread-162369.html · Note