CVE-2008-4928: XSS

Published Nov 4, 2008

Updated

Cross-site scripting (XSS) vulnerability in the redirect function in functions.php in MyBB (aka MyBulletinBoard) 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter in a removesubscriptions action to moderation.php, related to use of the ajax option to request a JavaScript redirect. NOTE: this can be leveraged to execute PHP code and bypass cross-site request forgery (CSRF) protection.

Affected Software

1 affected component

Mybb Mybb=1.4.2

Event History

Nov 4, 2008

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-4928?

CVE-2008-4928 is classified as a medium severity cross-site scripting (XSS) vulnerability.

How do I fix CVE-2008-4928?

To fix CVE-2008-4928, upgrade MyBB to version 1.4.3 or later to eliminate the vulnerability.

What type of vulnerability is CVE-2008-4928?

CVE-2008-4928 is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject web scripts.

What software is affected by CVE-2008-4928?

CVE-2008-4928 affects MyBB version 1.4.2 specifically.

Can CVE-2008-4928 lead to data theft?

Yes, CVE-2008-4928 can lead to data theft as attackers can execute malicious scripts in the context of the user's session.