PT-2021-23436 · Mybb · Mybb

Vz · Published 2021-10-26 · Updated 2024-03-06 · CVE-2021-41866

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.28

Description The issue allows stored XSS because the displayed Template Name value in the Admin CP's theme management is not escaped properly.

Recommendations For versions prior to 1.8.28, update to version 1.8.28 or later to resolve the issue. As a temporary workaround, consider restricting access to the theme management in the Admin CP to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-MYBB-2021-41866

CVE-2021-41866

GHSA-GXHV-R3M5-6QV7

Affected Products

Mybb

References · 7

• https://github.com/mybb/mybb/security/advisories/GHSA-gxhv-r3m5-6qv7 · Patch
• https://osv.dev/vulnerability/CVE-2021-41866 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mybb-2021-41866 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41866 · Security Note
• https://github.com/mybb/mybb/security/advisories · Note
• https://t.me/cibsecurity/31259 · Telegram Post
• https://t.me/cvenotify/22452 · Telegram Post