CVE-2015-8973

HIGH

MyBB < 1.6.18 and 1.8.x < 1.8.6 and Merge System < 1.8.6 - Unauthenticated Access Control Bypass via Forum Password

Title source: llm

Description

xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password.

References (4)

Core 4

Core References

Release Notes, Vendor Advisory x_refsource_confirm

https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/94397

Mailing List, Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2016/11/18/1

Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2016/11/10/8

Scores

CVSS v3 8.3

EPSS 0.0163

EPSS Percentile 73.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Details

CWE

CWE-284

Status published

Products (8)

mybb/merge_system < 1.8.5

mybb/mybb 1.8.0

mybb/mybb 1.8.1

mybb/mybb 1.8.2

mybb/mybb 1.8.3

mybb/mybb 1.8.4

mybb/mybb 1.8.5

mybb/mybb < 1.6.17

Published Jan 31, 2017

Tracked Since Feb 18, 2026