CVE-2021-47934: MyBB Timeline Plugin 1.0 Cross-Site Scripting and CSRF
MyBB Timeline Plugin 1.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through thread titles, post content, and user profile fields like Location and Bio. Attackers can also exploit a cross-site request forgery vulnerability in the timeline.php profile action to change a user's cover picture by crafting malicious forms that execute when victims visit affected profiles.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-47934?
CVE-2021-47934 is considered a high-severity vulnerability due to its potential for cross-site scripting and CSRF attacks.
How do I fix CVE-2021-47934?
To fix CVE-2021-47934, upgrade the MyBB Timeline Plugin to version 1.0.1 or higher, if available, and implement proper input validation.
What are the consequences of CVE-2021-47934 if exploited?
Exploiting CVE-2021-47934 may allow an attacker to execute arbitrary scripts in the context of a user's session, which can lead to data theft or account compromise.
Who is affected by CVE-2021-47934?
CVE-2021-47934 specifically affects users of the MyBB Timeline Plugin version 1.0.
What types of attacks can CVE-2021-47934 enable?
CVE-2021-47934 can enable cross-site scripting (XSS) attacks and cross-site request forgery (CSRF) attacks against users interacting with the affected plugin.