CVE-2023-41362

Katalog CVE

CVSS 7.2 · High EPSS 2,1%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada mybb. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP.

Rincian

Terbit di NVD

29 Agustus 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

2,1% peluang dieksploitasi; lebih tinggi dari 80,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mybb/mybb/commit/a43a6f22944e769a6eabc58c39e7bc18c1cab4ca.patch patch
• https://github.com/mybb/mybb/security/advisories/GHSA-pr74-wvp3-q6f5 patch · advisory pihak ketiga
• https://blog.sorcery.ie/posts/mybb_acp_rce/
• https://mybb.com/versions/1.8.36/ release notes