high8.3
CVE-2015-8973
xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended ac…
Impact
xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mybb | Merge System | through 1.8.5 |
| Mybb | Mybb | through 1.6.17 Versions 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.8.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.openwall.com/lists/oss-security/2016/11/10/8
- http://www.openwall.com/lists/oss-security/2016/11/18/1
- http://www.securityfocus.com/bid/94397
- https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/
- http://www.openwall.com/lists/oss-security/2016/11/10/8
- http://www.openwall.com/lists/oss-security/2016/11/18/1
- http://www.securityfocus.com/bid/94397
- https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/