PT-2023-21737 · Mybb · Mybb

Dvz · Published 2023-05-22 · Updated 2024-03-06 · CVE-2023-28467

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.34

Description The issue concerns a cross-site scripting (XSS) flaw in the User CP module, specifically via the user email field. This allows for potential malicious script execution.

Recommendations For versions prior to 1.8.34, update to version 1.8.34 or later to resolve the issue. As a temporary workaround, consider restricting access to the User CP module until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-MYBB-2023-28467

CVE-2023-28467

GHSA-3Q8X-9FH2-V646

Affected Products

Mybb

References · 9

• 🔥 https://github.com/ahmetaltuntas/CVE-2023-28467 · Exploit
• https://github.com/mybb/mybb/security/advisories/GHSA-3q8x-9fh2-v646 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-28467 · Security Note
• https://osv.dev/vulnerability/BIT-mybb-2023-28467 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28467 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/8720 · Telegram Post
• https://t.me/cvenotify/50930 · Telegram Post
• https://t.me/cibsecurity/64563 · Telegram Post
• https://mybb.com · Note