PT-2024-19816 · Apache · Apache

Shin24 · Published 2024-05-01 · Updated 2025-06-30 · CVE-2024-23335

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.38

Description The backup management module of the Admin CP in MyBB may accept .htaccess as the name of the backup file to be deleted, potentially exposing stored backup files over HTTP on Apache servers.

Recommendations For MyBB versions prior to 1.8.38, upgrade to MyBB 1.8.38 to resolve the issue. As a temporary workaround, consider restricting access to the backup management module in the Admin CP until the upgrade is applied.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-23335

GHSA-94XR-G4WW-J47R

Affected Products

Apache

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23335.json · Exploit
• https://github.com/mybb/mybb/security/advisories/GHSA-94xr-g4ww-j47r · Vendor Advisory
• https://github.com/mybb/mybb/commit/450259e501b94c9d483efb167cb2bf875605e111.patch · Patch
• https://osv.dev/vulnerability/CVE-2024-23335 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23335 · Security Note
• https://twitter.com/linuxpatch/status/1785581328932417561 · Twitter Post
• https://mybb.com/versions/1.8.38 · Note
• https://twitter.com/VulmonFeeds/status/1785622491395674458 · Twitter Post
• https://twitter.com/CVEnew/status/1785569978798026966 · Twitter Post
• https://t.me/cvenotify/127123 · Telegram Post
• https://t.me/cvenotify/78664 · Telegram Post