A vulnerability classified as problematic has been found in MyBB 1.8.3 (Content Management System). Affected is an unknown functionality. The manipulation with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity.

The weakness was published 02/21/2015 as not defined mailinglist post (oss-sec). The advisory is available at seclists.org. This vulnerability is traded as CVE-2015-2149 since 02/27/2015. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. Technical details are unknown but an exploit is available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 03/10/2022). This vulnerability is assigned to T1059.007 by the MITRE ATT&CK project.

It is declared as highly functional.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at X-Force (101042). Similar entries are available at 74083, 74084, 74085 and 74086.

Productinfo

Type

• Content Management System

Name

• MyBB

Version

• 1.8.3

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion