Description
MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.
References (4)
Core 4
Core References
Release Notes, Vendor Advisory x_refsource_confirm
https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/94397
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/11/18/1
Third Party Advisory mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/11/10/8
Scores
CVSS v3
7.5
EPSS
0.0122
EPSS Percentile
79.1%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-532
Status
published
Products (8)
mybb/merge_system
< 1.8.5
mybb/mybb
1.8.0
mybb/mybb
1.8.1
mybb/mybb
1.8.2
mybb/mybb
1.8.3
mybb/mybb
1.8.4
mybb/mybb
1.8.5
mybb/mybb
< 1.6.17
Published
Jan 31, 2017
Tracked Since
Feb 18, 2026