CVE-2015-8977

HIGH

MyBB Merge System < 1.8.6 and MyBB < 1.6.18 - Sensitive Information Disclosure via Error Log Files

Title source: llm

Description

MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.

References (4)

Core 4

Core References

Release Notes, Vendor Advisory x_refsource_confirm

https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/94397

Mailing List, Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2016/11/18/1

Third Party Advisory mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2016/11/10/8

Scores

CVSS v3 7.5

EPSS 0.0225

EPSS Percentile 80.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-532

Status published

Products (8)

mybb/merge_system < 1.8.5

mybb/mybb 1.8.0

mybb/mybb 1.8.1

mybb/mybb 1.8.2

mybb/mybb 1.8.3

mybb/mybb 1.8.4

mybb/mybb 1.8.5

mybb/mybb < 1.6.17

Published Jan 31, 2017

Tracked Since Feb 18, 2026