Description

xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password.

Remediation

References

CVE-2015-8973

Related Vulnerabilities

Handlebars Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2019-19919)

WordPress 5.2.x Multiple Vulnerabilities (5.2 - 5.2.15)

Envoy Proxy Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2021-29492)

Moodle Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2015-0213)

WordPress Plugin Business Directory-Easy Listing Directories for WordPress Multiple Vulnerabilities (5.11.1)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Tags

Missing Update Known Vulnerabilities CWE-284 CVE-2015-8973