CVE-2013-7288: XSS
Published Jan 10, 2014
·Updated
Cross-site scripting (XSS) vulnerability in the mycodeparsevideo function in inc/classparser.php in MyBB (aka MyBulletinBoard) before 1.6.12 allows remote attackers to inject arbitrary web script or HTML via vectors related to Yahoo video URLs.
Affected Software
69 affected components
Mybb Mybb<=1.6.11
Mybb Mybb=1.00
Mybb Mybb=1.0-beta4
Mybb Mybb=1.0-pr1
Mybb Mybb=1.0-pr2
Mybb Mybb=1.0-rc1
Mybb Mybb=1.0-rc2
Mybb Mybb=1.0-rc3
Mybb Mybb=1.0-rc4
Mybb Mybb=1.01
Mybb Mybb=1.1.0
Mybb Mybb=1.1.1
Mybb Mybb=1.1.2
Mybb Mybb=1.1.3
Mybb Mybb=1.1.4
Mybb Mybb=1.1.5
Mybb Mybb=1.1.6
Mybb Mybb=1.1.7
Mybb Mybb=1.1.8
Mybb Mybb=1.02
Mybb Mybb=1.2
Mybb Mybb=1.2.0
Mybb Mybb=1.2.1
Mybb Mybb=1.2.2
Mybb Mybb=1.2.3
Mybb Mybb=1.2.4
Mybb Mybb=1.2.5
Mybb Mybb=1.2.6
Mybb Mybb=1.2.7
Mybb Mybb=1.2.8
Mybb Mybb=1.2.9
Mybb Mybb=1.2.10
Mybb Mybb=1.2.11
Mybb Mybb=1.2.12
Mybb Mybb=1.2.13
Mybb Mybb=1.2.14
Mybb Mybb=1.03
Mybb Mybb=1.3-pre-1.0
Mybb Mybb=1.04
Mybb Mybb=1.4.0
Mybb Mybb=1.4.1
Mybb Mybb=1.4.2
Mybb Mybb=1.4.3
Mybb Mybb=1.4.4
Mybb Mybb=1.4.5
Mybb Mybb=1.4.6
Mybb Mybb=1.4.7
Mybb Mybb=1.4.8
Mybb Mybb=1.4.9
Mybb Mybb=1.4.10
Mybb Mybb=1.4.11
Mybb Mybb=1.4.12
Mybb Mybb=1.4.13
Mybb Mybb=1.4.14
Mybb Mybb=1.4.15
Mybb Mybb=1.4.16
Mybb Mybb=1.5.1
Mybb Mybb=1.5.2
Mybb Mybb=1.6.0
Mybb Mybb=1.6.1
Mybb Mybb=1.6.2
Mybb Mybb=1.6.3
Mybb Mybb=1.6.4
Mybb Mybb=1.6.5
Mybb Mybb=1.6.6
Mybb Mybb=1.6.7
Mybb Mybb=1.6.8
Mybb Mybb=1.6.9
Mybb Mybb=1.6.10
Event History
Jan 10, 2014
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Data Sourced
via NVD·04:47 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2013-7288?
CVE-2013-7288 is classified as a medium severity vulnerability due to its cross-site scripting (XSS) nature.
2
How do I fix CVE-2013-7288?
To fix CVE-2013-7288, upgrade MyBB to version 1.6.12 or later.
3
What system versions are affected by CVE-2013-7288?
CVE-2013-7288 affects MyBB versions prior to 1.6.12, including 1.6.11 and earlier versions.
4
Can CVE-2013-7288 be exploited remotely?
Yes, CVE-2013-7288 can be exploited remotely by attackers through manipulated Yahoo video URLs.
5
What type of vulnerability is CVE-2013-7288?
CVE-2013-7288 is a cross-site scripting (XSS) vulnerability allowing injection of arbitrary web script or HTML.