CVE-2008-7082: CSRF

Published Aug 25, 2009

Updated

MyBB (aka MyBulletinBoard) 1.4.3 includes the sensitive mypostkey parameter in URLs to moderation.php with the (1) mergeposts, (2) split, and (3) deleteposts actions, which allows remote attackers to steal the token and bypass the cross-site request forgery (CSRF) protection mechanism to hijack the authentication of moderators by reading the token from the HTTP Referer header.

Affected Software

2 affected components

Mybboard Mybb=1.4.3

MyBB MyBB=1.4.3

Event History

Aug 25, 2009

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Data Sourced

via NVD·10:30 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2008-7082?

CVE-2008-7082 is considered to be of medium severity due to the potential for an attacker to bypass CSRF protections.

How do I fix CVE-2008-7082?

To fix CVE-2008-7082, upgrade to a later version of MyBB that has addressed this CSRF vulnerability.

What actions are affected by CVE-2008-7082?

CVE-2008-7082 affects the mergeposts, split, and deleteposts actions in moderation.php.

Who is affected by CVE-2008-7082?

Anyone using MyBB version 1.4.3 is vulnerable to CVE-2008-7082 and should take immediate action.

What type of attack does CVE-2008-7082 enable?

CVE-2008-7082 enables remote attackers to perform unauthorized actions by stealing the my_post_key token.