CVE-2024-52702: XSS

Published Nov 20, 2024

Updated

A stored cross-site scripting (XSS) vulnerability in the component install\index.php of MyBB v1.8.38 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Name parameter. NOTE: this is disputed by the Supplier because Website Name can only be set by an administrator, who may use JavaScript if they wish.

Affected Software

2 affected components

MyBB MyBB

MyBB MyBB=1.8.38

Event History

Nov 20, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·09:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-52702?

CVE-2024-52702 is classified as a high-severity stored cross-site scripting vulnerability.

How do I fix CVE-2024-52702?

To fix CVE-2024-52702, update MyBB to version 1.8.39 or later, which addresses the vulnerability.

What are the consequences of exploiting CVE-2024-52702?

Exploiting CVE-2024-52702 can allow attackers to execute arbitrary web scripts or HTML, potentially compromising user data and site integrity.

Which component is affected by CVE-2024-52702?

CVE-2024-52702 affects the install/index.php component of MyBB version 1.8.38.

Who is affected by CVE-2024-52702?

Anyone using MyBB version 1.8.38 without applying the latest patches may be affected by CVE-2024-52702.