CVE-2018-1000503

EPSS 0.15%
Published 26.06.2018 16:29:00
Last modified 21.11.2024 03:40:03
Source cve@mitre.org
Teams watchlist Login
Open Login

MyBB Group MyBB contains a Incorrect Access Control vulnerability in Private forums that can result in Users can view posts from private forums without having the password. This attack appear to be exploitable via Subscribe to a forum through IDOR. This vulnerability appears to have been fixed in 1.8.15.

Affected products Warnungen 0 Metrics 3 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Mybb ≫ Mybb Version < 1.8.15

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.15%	0.32

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	4.3	2.8	1.4	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvd@nist.gov	4	8	2.9	AV:N/AC:L/Au:S/C:P/I:N/A:N

CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

http://www.batterystapl.es/2018/03/local-file-inclusion-and-reading.html

Third Party Advisory

https://blog.mybb.com/2018/03/15/mybb-1-8-15-released-security-maintenance-release/

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2018-1000503

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2018-1000503

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2018-1000503

EUVD