PT-2020-14219 · Mybb · Mybb

Murphy · Published 2020-08-10 · Updated 2024-03-06 · CVE-2020-15139

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.24

Description The issue arises from improper input escaping in the custom MyCode for the visual editor, leading to a DOM-based XSS vulnerability. This can be exploited by directing a victim to a page with the visual editor active, such as a post or Private Message, where it operates on a maliciously crafted MyCode message. Exploitation scenarios include pages with pre-filled message content using GET/POST parameters or reply pages quoting previously saved malicious messages.

Recommendations For versions prior to 1.8.24, upgrade to version 1.8.24 and ensure the version attribute in the codebuttons template is updated for non-default themes to serve the latest version of the patched jscripts/bbcodes sceditor.js file.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-MYBB-2020-15139

CVE-2020-15139

GHSA-37H7-VFV6-F8RJ

Affected Products

Mybb

References · 6

• https://github.com/mybb/mybb/commit/37ad29dcd25489a37bdd89ebac761f22492558b0 · Patch
• https://github.com/mybb/mybb/security/advisories/GHSA-37h7-vfv6-f8rj · Patch
• https://mybb.com/versions/1.8.24 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15139 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15139 · Security Note
• https://osv.dev/vulnerability/BIT-mybb-2020-15139 · Vendor Advisory