Lucene search

Tenable700070.PRM

HistoryMay 02, 2017 - 12:00 a.m.

MyBB < 1.8.11 Multiple Vulnerabilities

2017-05-0200:00:00

Tenable

www.tenable.com

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS

0.004

Percentile

72.6%

JSON

Versions of MyBB (MyBulletinBoard) prior to 1.8.11 are affected by the following vulnerabilities :

The file ‘usercp.php’ contains an error that can allow server side request forgery (SSRF) via specially-crafted requests. (CVE-2017-7566)
An unspecified user-input error can allow cross-site scripting attacks (XSS). (CVE-2017-8103)
The file ‘upload/admin/modules/config/smilies.php’ contains a user-input validation error that can allow file disclosure via path traversal. (CVE-2017-8104)

Binary data 700070.prm

References

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7566

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8103

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8104

blog.mybb.com/2017/04/04/mybb-1-8-11-merge-system-1-8-11-release

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS

0.004

Percentile

72.6%

JSON

Related for 700070.PRM