CVE-2024-23336

Katalog CVE

CVSS 5.0 · Medium EPSS 0,46%

Kerentanan Incomplete List of Disallowed Inputs pada mybb. Skor CVSS 3.1 5.0 (Medium) menurut github.com.

Deskripsi (NVD)

MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's _Disallowed Remote Addresses_ list (`$config['disallowed_remote_addresses']`) contains the address `127.0.0.1`, but does not include the complete block `127.0.0.0/8`. MyBB 1.8.38 resolves this issue in default installations. Administrators of installed boards should update the existing configuration (`inc/config.php`) to include all addresses blocked by default. Additionally, users are advised to verify that it includes any other IPv4 addresses resolving to the server and other internal resources. Users unable to upgrade may manually add 127.0.0.0/8' to their disallowed address list.

Rincian

Terbit di NVD

1 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.0 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-184: Incomplete List of Disallowed Inputs
CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 37,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mybb/mybb/security/advisories/GHSA-qfrj-65mv-h75h advisory vendor
• https://github.com/mybb/mybb/commit/d6a96019025de9149014e06b1df252e6122e5630 patch
• https://docs.mybb.com/1.8/administration/configuration-file product
• https://mybb.com/versions/1.8.38 product · release notes