CVE-2015-2149: XSS
Multiple cross-site scripting (XSS) vulnerabilities in the administrative backend in MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the (1) MIME-type field in an add action in the config-attachmenttypes module to admin/index.php; (2) title or (3) short description field in an add action in the (a) config-mycode or (b) user-groups module to admin/index.php; (4) title field in an add action in the (c) forum-management or (d) tool-tasks module to admin/index.php; (5) name field in an addset action in the style-templates module to admin/index.php; (6) title field in an addtemplategroup action in the style-templates module to admin/index.php; (7) name field in an add action in the config-posticons module to admin/index.php; (8) "title to assign" field in an add action in the user-titles module to admin/index.php; or (9) username field in the config-banning module to admin/index.php.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-2149?
CVE-2015-2149 is classified as a medium severity vulnerability due to its potential to allow cross-site scripting attacks.
How do I fix CVE-2015-2149?
To fix CVE-2015-2149, upgrade MyBB to version 1.8.4 or later.
Who is affected by CVE-2015-2149?
CVE-2015-2149 affects all versions of MyBB prior to 1.8.4.
What types of attacks can CVE-2015-2149 facilitate?
CVE-2015-2149 can facilitate cross-site scripting (XSS) attacks, allowing attackers to inject arbitrary web scripts or HTML.
Is CVE-2015-2149 an authenticated vulnerability?
Yes, CVE-2015-2149 requires remote authenticated users to exploit the vulnerability.