KLA10465 Multiple vulnerabilities in MyBB

Multiple serious vulnerabilities have been found in MyBB. Malicious users can exploit these vulnerabilities to obtain sensitive information or conduct cross site scrtipting.

Below is a complete list of vulnerabilities

1. An unknown vulnerability can be exploited remotely via vectors related to JSON;
2. CSRF vulnerability can be exploited remotely via unknown vectors;
3. XSS vulnerability can be exploited remotely via vectors related to administrative backend;

Original advisories

MyBB DevBlog

Related products

MyBB

CVE list

CVE-2015-2334 high

CVE-2015-2335 critical

CVE-2015-2332 warning

CVE-2015-2333 warning

CVE-2015-2149 warning

Solution

Update to latest version!

Get MyBB

Impacts

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• CI

Code injection. Exploitation of vulnerabilities with this impact can lead to changes in target code.

Affected Products

• MyBB versions earlier than 1.8.4