PT-2023-29931 · Sceditor+1 · Sceditor+1

Paulos Yibelo · Published 2023-11-06 · Updated 2024-03-06 · CVE-2023-46251

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.37

Description The issue arises from custom MyCode (BBCode) for the visual editor ( SCEditor ) not escaping input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual editor is active and operates on a maliciously crafted MyCode message. The impact can occur on pages where message content is pre-filled using a GET/POST parameter, or on reply pages where a previously saved malicious message is quoted.

Recommendations For MyBB versions prior to 1.8.37, upgrade to version 1.8.37 to resolve the issue. As a temporary workaround, consider disabling the visual editor globally by setting Clickable Smilies and BB Code → Clickable MyCode Editor to Off in the Admin CP. Alternatively, individual users can disable the visual editor by unchecking the Show the MyCode formatting options on the posting pages checkbox in their User CP.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-MYBB-2023-46251

CVE-2023-46251

GHSA-WJ33-Q7VJ-9FR8

Affected Products

Mybb

Sceditor

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46251.json · Exploit
• https://github.com/mybb/mybb/security/advisories/GHSA-wj33-q7vj-9fr8 · Vendor Advisory
• https://github.com/mybb/mybb/commit/6dcaf0b4db6254f1833fe8dae295d9ddc2219276 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-46251 · Security Note
• https://osv.dev/vulnerability/BIT-mybb-2023-46251 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-46251 · Vendor Advisory
• https://mybb.com/versions/1.8.37 · Note
• https://t.me/cibsecurity/73623 · Telegram Post
• https://t.me/proxy_bar/1814 · Telegram Post