MyBB up to 1.4.11 access control

Summaryinfo

A vulnerability described as critical has been identified in MyBB. This impacts an unknown function. Executing a manipulation can lead to access control. This vulnerability is registered as CVE-2010-4624. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical was found in MyBB (Content Management System). This vulnerability affects an unknown code block. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-264. As an impact it is known to affect integrity. CVE summarizes:

MyBB (aka MyBulletinBoard) before 1.4.12 allows remote authenticated users to bypass intended restrictions on the number of [img] MyCodes by editing a post after it has been created.

The weakness was published 12/30/2010 (Website). The advisory is shared for download at blog.mybb.com. This vulnerability was named CVE-2010-4624 since 12/30/2010. The attack can be initiated remotely. The requirement for exploitation is a single authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 1.2.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at X-Force (64518). Similar entries are available at VDB-55905, VDB-55904, VDB-55903 and VDB-55902. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Name

• MyBB

Version

• 1.00
• 1.01
• 1.02
• 1.03
• 1.04
• 1.1.0
• 1.1.1
• 1.1.2
• 1.1.3
• 1.1.4
• 1.1.5
• 1.1.6
• 1.1.7
• 1.1.8
• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7
• 1.2.8
• 1.2.9
• 1.2.10
• 1.2.11
• 1.2.12
• 1.2.13
• 1.4.0
• 1.4.2
• 1.4.3
• 1.4.6
• 1.4.8
• 1.4.9
• 1.4.10
• 1.4.11

License

• open-source

Website

• Product: https://mybb.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion