CVE-2023-41362: Code Injection
First published: Tue Aug 29 2023(Updated: )
MyBB before 1.8.36 allows Code Injection by users with certain high privileges. Templates in Admin CP intentionally use eval, and there was some validation of the input to eval, but type juggling interfered with this when using PCRE within PHP.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mybb Mybb | <1.8.36 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-41362?
CVE-2023-41362 is a vulnerability in MyBB before version 1.8.36 that allows code injection by users with certain high privileges.
How severe is CVE-2023-41362?
CVE-2023-41362 has a severity keyword of 'high' and a severity value of 7.2.
What software is affected by CVE-2023-41362?
The MyBB software before version 1.8.36 is affected by CVE-2023-41362.
How can I fix CVE-2023-41362?
To fix CVE-2023-41362, you should update MyBB to version 1.8.36 or newer.
What is CWE-94?
CWE-94 is a vulnerability related to code injection.
- collector/nvd-api
- collector/nvd-index
- agent/author
- agent/severity
- agent/weakness
- agent/references
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/remedy
- agent/first-publish-date
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/mybb
- canonical/mybb mybb