Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-23335

Good to know:

icon

Date: May 1, 2024

MyBB is a free and open source forum software. The backup management module of the Admin CP may accept `.htaccess` as the name of the backup file to be deleted, which may expose the stored backup files over HTTP on Apache servers. MyBB 1.8.38 resolves this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability

Language: PHP

Severity Score

Related Resources (5)

https://github.com/mybb/mybb/commit/450259e501b94c9d483efb167cb2bf875605e111.patch
https://nvd.nist.gov/vuln/detail/CVE-2024-23335
https://mybb.com/versions/1.8.38
https://github.com/mybb/mybb/security/advisories/GHSA-94xr-g4ww-j47r
https://www.mend.io/vulnerability-database/CVE-2024-23335

Severity Score

Weakness Type (CWE)

Input Validation

CWE-20

Top Fix

icon

Upgrade Version

Upgrade to version mybb_1838

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): HIGH
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): LOW

Do you need more information?

Contact Us