Design/Logic Flaw

2017-01-3122:59:00

PRIOn knowledge base

www.prio-n.com

7.1 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

60.9%

JSON

MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.

CPENameOperatorVersion
merge_systemle1.8.5
mybbeq1.8.1
mybbeq1.8.0
mybbeq1.8.3
mybbeq1.8.5
mybbeq1.8.4
mybbeq1.8.2
mybble1.6.17

Name	Operator	Version
merge_system	le	1.8.5
mybb	eq	1.8.1
mybb	eq	1.8.0
mybb	eq	1.8.3
mybb	eq	1.8.5
mybb	eq	1.8.4
mybb	eq	1.8.2
mybb	le	1.6.17

References

www.openwall.com/lists/oss-security/2016/11/10/8

www.openwall.com/lists/oss-security/2016/11/18/1

www.securityfocus.com/bid/94397

blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/