Vulnerability · Published Aug 10, 2020 · Assigned by GitHub_M

CVE-2020-15139XSS in MyBB

High 8.8

In plain English

A high-severity cross-site scripting in MyBB from MyBB. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.3%top 29.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In MyBB before version 1.8.24, the custom MyCode (BBCode) for the visual editor doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. The weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as a post or Private Message) and operates on a maliciously crafted MyCode message. This may occur on pages where message content is pre-filled using a GET/POST parameter, or on reply pages where a previously saved malicious message is quoted. After upgrading MyBB to 1.8.24, make sure to update the version attribute in the `codebuttons` template for non-default themes to serve the latest version of the patched `jscripts/bbcodes_sceditor.js` file.

Affected products (as reported)

Vendor	Product	Versions
MyBB	MyBB	< 1.8.24

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/mybb/mybb/security/advisories/GHSA-37h7-vfv6-f8rj x_refsource_CONFIRM
https://github.com/mybb/mybb/commit/37ad29dcd25489a37bdd89ebac761f22492558b0 x_refsource_MISC
https://mybb.com/versions/1.8.24/ x_refsource_MISC