PT-2021-17751 · Mybb · Ougc Feedback

Sama34 · Published 2021-03-09 · Updated 2021-03-13 · CVE-2021-28115

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: OUGC Feedback plugin versions prior to 1.8.23 for MyBB

Description: The issue allows for XSS via the comment field of feedback during an edit operation.

Recommendations: For versions prior to 1.8.23, update to version 1.8.23 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-28115

Affected Products

Ougc Feedback

References · 5

• 🔥 http://packetstormsecurity.com/files/161746/MyBB-OUGC-Feedback-1.8.22-Cross-Site-Scripting.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-28115 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28115 · Security Note
• https://github.com/Sama34/OUGC-Feedback/pull/31/commits/ceef7c06359e5dcbaffe90a40884265c5754068c · Patch
• https://t.me/cibsecurity/24664 · Telegram Post