Lucene search

[email protected]CVE-2006-1282

HistoryMar 19, 2006 - 11:06 a.m.

CVE-2006-1282

2006-03-1911:06:00

[email protected]

web.nvd.nist.gov

crlf injection

mybulletinboard

mybb 1.04

xss

cache poisoning

page hijacking

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.5 Medium

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.1%

JSON

CRLF injection vulnerability in inc/function.php in MyBulletinBoard (MyBB) 1.04 allows remote attackers to conduct cross-site scripting (XSS), poison caches, or hijack pages via CRLF (%0A%0D) sequences in the Referrer HTTP header field, possibly when redirecting to other web pages.

Affected configurations

NVD

Node

mybulletinboardmybulletinboardMatch1.0.1

mybulletinboardmybulletinboardMatch1.0.2

mybulletinboardmybulletinboardMatch1.0.3

mybulletinboardmybulletinboardMatch1.0.4

mybulletinboardmybulletinboardMatch1.0_final

mybulletinboardmybulletinboardMatch1.0_pr2

mybulletinboardmybulletinboardMatchrc1

mybulletinboardmybulletinboardMatchrc2

mybulletinboardmybulletinboardMatchrc3

mybulletinboardmybulletinboardMatchrc4

CPENameOperatorVersion
mybulletinboard:mybulletinboardmybulletinboardeq1.0.1
mybulletinboard:mybulletinboardmybulletinboardeq1.0.2
mybulletinboard:mybulletinboardmybulletinboardeq1.0.3
mybulletinboard:mybulletinboardmybulletinboardeq1.0.4
mybulletinboard:mybulletinboardmybulletinboardeq1.0_final
mybulletinboard:mybulletinboardmybulletinboardeq1.0_pr2
mybulletinboard:mybulletinboardmybulletinboardeqrc1
mybulletinboard:mybulletinboardmybulletinboardeqrc2
mybulletinboard:mybulletinboardmybulletinboardeqrc3
mybulletinboard:mybulletinboardmybulletinboardeqrc4

CPE	Name	Operator	Version
mybulletinboard:mybulletinboard	mybulletinboard	eq	1.0.1
mybulletinboard:mybulletinboard	mybulletinboard	eq	1.0.2
mybulletinboard:mybulletinboard	mybulletinboard	eq	1.0.3
mybulletinboard:mybulletinboard	mybulletinboard	eq	1.0.4
mybulletinboard:mybulletinboard	mybulletinboard	eq	1.0_final
mybulletinboard:mybulletinboard	mybulletinboard	eq	1.0_pr2
mybulletinboard:mybulletinboard	mybulletinboard	eq	rc1
mybulletinboard:mybulletinboard	mybulletinboard	eq	rc2
mybulletinboard:mybulletinboard	mybulletinboard	eq	rc3
mybulletinboard:mybulletinboard	mybulletinboard	eq	rc4

References

community.mybboard.net/showthread.php?tid=7368

kapda.ir/advisory-295.html

myimei.com/security/2006-03-10/mybb104redirectfunctionheaderinjection.html

www.securityfocus.com/archive/1/427747/100/0/threaded

www.securityfocus.com/bid/17097

exchange.xforce.ibmcloud.com/vulnerabilities/25267

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.5 Medium

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.1%

JSON

Related for CVE-2006-1282

cvelist1 nvd1 prion1