CVE-2006-3420: CSRF

Published Jul 7, 2006

Updated

Cross-site request forgery (CSRF) vulnerability in editpost.php in MyBulletinBoard (MyBB) before 1.1.5 allows remote attackers to perform unauthorized actions as a logged in user and delete arbitrary forum posts via a bbcode IMG tag with a modified delete parameter in a deletepost action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Affected Software

5 affected components

MyBulletinBoard MyBulletinBoard=1.1.1

MyBulletinBoard MyBulletinBoard=1.1.3

MyBulletinBoard MyBulletinBoard=1.1

MyBulletinBoard MyBulletinBoard=1.1.4

MyBulletinBoard MyBulletinBoard=1.1.2

Event History

Jul 7, 2006

CVE Published

12:05 AM

CVE Published

via MITRE·04:00 AM

Data Sourced

via MITRE·04:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-3420?

CVE-2006-3420 is considered a high severity vulnerability due to the ability to perform unauthorized actions as a logged-in user.

How do I fix CVE-2006-3420?

To fix CVE-2006-3420, upgrade MyBulletinBoard to version 1.1.5 or later.

What actions can be exploited with CVE-2006-3420?

CVE-2006-3420 allows remote attackers to delete arbitrary forum posts by exploiting CSRF vulnerabilities.

Which versions of MyBulletinBoard are affected by CVE-2006-3420?

CVE-2006-3420 affects MyBulletinBoard versions 1.1.1 through 1.1.4.

What type of vulnerability is CVE-2006-3420?

CVE-2006-3420 is a cross-site request forgery (CSRF) vulnerability.