Lucene search

MitreCVE-2008-0788

HistoryFeb 15, 2008 - 1:00 a.m.

CVE-2008-0788

2008-02-1501:00:00

CWE-352

mitre

web.nvd.nist.gov

csrf

mybb

authentication

remote attack

vulnerability

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.3

Confidence

Low

EPSS

0.005

Percentile

75.9%

JSON

Multiple cross-site request forgery (CSRF) vulnerabilities in MyBB 1.2.11 and earlier allow remote attackers to (1) hijack the authentication of moderators or administrators for requests that delete threads via a do_multideletethreads action to moderation.php and (2) hijack the authentication of arbitrary users for requests that delete private messages (PM) via a delete action to private.php.

Affected configurations

Nvd

Node

mybbmybbRange≤1.2.11

VendorProductVersionCPE
mybbmybb*cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mybb	mybb	*	cpe:2.3:a:mybb:mybb::::::::

References

community.mybboard.net/showthread.php?tid=27675

secunia.com/advisories/28572/

securityreason.com/securityalert/3656

www.securityfocus.com/archive/1/486663

www.vupen.com/english/advisories/2008/0238

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.3

Confidence

Low

EPSS

0.005

Percentile

75.9%

JSON

Related for CVE-2008-0788