PT-2020-7660 · Mybb · Mybb

Atofighi · Published 2020-02-11 · Updated 2020-02-12 · CVE-2014-3827

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.4

Description The issue allows remote authenticated users to inject arbitrary web script or HTML. This can be achieved via the title parameter in the edit or add action in the user-users module, the finduser action, or the name parameter in an edit action in the user-user module, or the editprofile action to modcp.php.

Recommendations For versions prior to 1.8.4, update to version 1.8.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the user-users module and modcp.php to minimize the risk of exploitation. Avoid using the title and name parameters in the affected actions until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-3827

Affected Products

Mybb

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2014-3827 · Security Note
• http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release · Vendor Advisory
• https://adamziaja.com/poc/201312-xss-mybb.html · Note