PT-2021-23801 · Mybb · Mybb

Dvz · Published 2021-11-04 · Updated 2024-03-06 · CVE-2021-43281

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.29

Description The issue allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with PHP code, executed on Change Settings pages.

Recommendations For MyBB versions prior to 1.8.29, update to version 1.8.29 or later to resolve the issue. As a temporary workaround, consider restricting the "Can manage settings?" permission to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BIT-MYBB-2021-43281

CVE-2021-43281

GHSA-8GXX-VMR9-H39P

Affected Products

Mybb

References · 5

• https://github.com/mybb/mybb/security/advisories/GHSA-8gxx-vmr9-h39p · Patch
• https://osv.dev/vulnerability/CVE-2021-43281 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mybb-2021-43281 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43281 · Security Note
• https://t.me/cibsecurity/31847 · Telegram Post