CVE-2024-23335 Backups directory .htaccess deletion in. MyBB

2024-05-0106:27:42

CWE-20

GitHub_M

raw.githubusercontent.com

cve-2024-23335

mybb

forum software

backup management

.htaccess

deletion

apache servers

vulnerability

upgrade

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.1%

JSON

MyBB is a free and open source forum software. The backup management module of the Admin CP may accept .htaccess as the name of the backup file to be deleted, which may expose the stored backup files over HTTP on Apache servers. MyBB 1.8.38 resolves this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability