PT-2025-17240 · Mybb · Mybb

Published 2025-03-09 · Updated 2025-04-29 · CVE-2025-29458

Positive Technologies (AI Summary)

CVSS v2.0

8.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:P/A:P

Name of the Vulnerable Software and Affected Versions MyBB version 1.8.38

Description An issue in MyBB allows a remote attacker to obtain sensitive information via the Change Avatar function. The supplier disputes this due to the allowed actions of Board administrators and SSRF mitigation.

Recommendations For MyBB version 1.8.38, consider disabling the Change Avatar function until a patch is available to prevent remote attackers from obtaining sensitive information.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2025-08884

CVE-2025-29458

Affected Products

Mybb

References · 12

• 🔥 https://yuque.com/morysummer/vx41bz/qu7zyyxr84qno64e · Exploit
• https://bdu.fstec.ru/vul/2025-08884 · Security Note
• https://osv.dev/vulnerability/CVE-2025-29458 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29458 · Security Note
• https://t.me/cvenotify/119505 · Telegram Post
• https://twitter.com/CVEnew/status/1913675354834915552 · Twitter Post
• https://docs.mybb.com/1.8/administration/security/protection/#limit-access-to-private-hosts-and-ip-addresses · Note
• https://twitter.com/yeule0/status/1917107704486625659 · Twitter Post
• https://twitter.com/autumn_good_35/status/1916831296048996665 · Twitter Post
• https://twitter.com/BruteBee/status/1916861996005282241 · Twitter Post
• https://t.me/cvetracker/21898 · Telegram Post
• https://t.me/cvedetector/23295 · Telegram Post