CVE-2018-1000503

Published: Jun 26, 2018Modified: Nov 21, 2024

4.3

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

MyBB Group MyBB contains a Incorrect Access Control vulnerability in Private forums that can result in Users can view posts from private forums without having the password. This attack appear to be exploitable via Subscribe to a forum through IDOR. This vulnerability appears to have been fixed in 1.8.15.

Affected (1)

Products: Mybb: Mybb

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mybb Mybb	Before 1.8.15

Related CWEs

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (4)

http://www.batterystapl.es/2018/03/local-file-inclusion-and-reading.html

Source: cve@mitre.org

Third Party Advisory

https://blog.mybb.com/2018/03/15/mybb-1-8-15-released-security-maintenance-release/

Source: cve@mitre.org

Vendor Advisory

http://www.batterystapl.es/2018/03/local-file-inclusion-and-reading.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://blog.mybb.com/2018/03/15/mybb-1-8-15-released-security-maintenance-release/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.