CVE-2006-3954: Medium severity MyBulletinBoard MyBulletinBoard vulnerability
Published Aug 1, 2006
·Updated
Directory traversal vulnerability in usercp.php in MyBB (aka MyBulletinBoard) 1.x allows remote attackers to read arbitrary files via a .. (dot dot) in the gallery parameter in a (1) avatar or (2) doavatar action.
Affected Software
26 affected components
MyBulletinBoard MyBulletinBoard=1.0.1
MyBulletinBoard MyBulletinBoard=1.0.2
MyBulletinBoard MyBulletinBoard=1.0.3
MyBulletinBoard MyBulletinBoard=1.0.4
MyBulletinBoard MyBulletinBoard=1.0_final
MyBulletinBoard MyBulletinBoard=1.0_pr2
MyBulletinBoard MyBulletinBoard=1.0_preview_release_2
MyBulletinBoard MyBulletinBoard=1.00_rc1
MyBulletinBoard MyBulletinBoard=1.00_rc2
MyBulletinBoard MyBulletinBoard=1.0_rc2
MyBulletinBoard MyBulletinBoard=1.00_rc3
MyBulletinBoard MyBulletinBoard=1.0_rc4
MyBulletinBoard MyBulletinBoard=1.00_rc4
MyBulletinBoard MyBulletinBoard=1.00_rc4_security_patch
MyBulletinBoard MyBulletinBoard=1.01
MyBulletinBoard MyBulletinBoard=1.1
MyBulletinBoard MyBulletinBoard=1.1.1
MyBulletinBoard MyBulletinBoard=1.1.2
MyBulletinBoard MyBulletinBoard=1.1.3
MyBulletinBoard MyBulletinBoard=1.1.4
MyBulletinBoard MyBulletinBoard=1.1.5
MyBulletinBoard MyBulletinBoard=1.1.7
MyBulletinBoard MyBulletinBoard=1.04
MyBulletinBoard MyBulletinBoard=1.10
MyBulletinBoard MyBulletinBoard=1.14
MyBulletinBoard MyBulletinBoard=1.20
Event History
Aug 1, 2006
CVE Published
09:04 PM
Aug 2, 2006
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-3954?
CVE-2006-3954 has a moderate severity level, as it allows unauthorized file access through directory traversal.
2
How do I fix CVE-2006-3954?
To fix CVE-2006-3954, upgrade MyBB to version 1.20 or later, which resolves the directory traversal vulnerability.
3
What versions of MyBB are affected by CVE-2006-3954?
CVE-2006-3954 affects MyBB versions 1.0_final through 1.14.
4
What actions can be exploited in CVE-2006-3954?
The exploit in CVE-2006-3954 can be triggered via the 'avatar' or 'do_avatar' actions.
5
Is user input validated in CVE-2006-3954?
CVE-2006-3954 indicates that user input is insufficiently validated, allowing for directory traversal attacks.