CVE-2009-4449

MEDIUM

MyBB 1.4.10 - Path Traversal

Title source: llm

Description

Directory traversal vulnerability in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, when changing the user avatar from the gallery, allows remote authenticated users to determine the existence of files via directory traversal sequences in the avatar and possibly the gallery parameters, related to (1) admin/modules/user/users.php and (2) usercp.php.

References (11)

[Release Notes] http://blog.mybboard.net/2009/12/29/mybb-1-4-11-released-minor-patch-security-update/

[Broken Link] http://dev.mybboard.net/issues/617

[Broken Link, Exploit] http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.4-stable/admin/modules/user/users.php

[Broken Link, Exploit] http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.4-stable/usercp.php

[Mailing List] http://openwall.com/lists/oss-security/2010/10/08/7

[Mailing List] http://openwall.com/lists/oss-security/2010/10/11/8

[Mailing List] http://openwall.com/lists/oss-security/2010/12/06/2

[Broken Link] http://osvdb.org/61359

[Broken Link, Vendor Advisory] http://secunia.com/advisories/37906

[Broken Link, Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/37489

[Permissions Required, Vendor Advisory] http://www.vupen.com/english/advisories/2009/3651

Scores

CVSS v3 6.5

EPSS 0.0050

EPSS Percentile 65.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-22

Status draft

Affected Products (1)

mybb/mybb

Timeline

Published Dec 29, 2009

Tracked Since Feb 18, 2026