CVE-2018-1000503

EPSS 0.15%
Veröffentlicht 26.06.2018 16:29:00
Zuletzt bearbeitet 21.11.2024 03:40:03
Quelle cve@mitre.org
Teams Watchlist Login
Unerledigt Login

MyBB Group MyBB contains a Incorrect Access Control vulnerability in Private forums that can result in Users can view posts from private forums without having the password. This attack appear to be exploitable via Subscribe to a forum through IDOR. This vulnerability appears to have been fixed in 1.8.15.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 5

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Mybb ≫ Mybb Version < 1.8.15

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.15%	0.32

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	4.3	2.8	1.4	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvd@nist.gov	4	8	2.9	AV:N/AC:L/Au:S/C:P/I:N/A:N

CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

http://www.batterystapl.es/2018/03/local-file-inclusion-and-reading.html

Third Party Advisory

https://blog.mybb.com/2018/03/15/mybb-1-8-15-released-security-maintenance-release/

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2018-1000503

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2018-1000503

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2018-1000503

EUVD