CVE-2009-4449 — MEDIUM (6.5)

Vulnerability Description

Directory traversal vulnerability in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, when changing the user avatar from the gallery, allows remote authenticated users to determine the existence of files via directory traversal sequences in the avatar and possibly the gallery parameters, related to (1) admin/modules/user/users.php and (2) usercp.php.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Mybb	Mybb	1.4.10

Related Weaknesses (CWE)

CWE-22

References

http://blog.mybboard.net/2009/12/29/mybb-1-4-11-released-minor-patch-security-upRelease Notes
http://dev.mybboard.net/issues/617Broken Link
http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.Broken LinkExploit
http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.Broken LinkExploit
http://openwall.com/lists/oss-security/2010/10/08/7Mailing List
http://openwall.com/lists/oss-security/2010/10/11/8Mailing List
http://openwall.com/lists/oss-security/2010/12/06/2Mailing List
http://osvdb.org/61359Broken Link
http://secunia.com/advisories/37906Broken LinkVendor Advisory
http://www.securityfocus.com/bid/37489Broken LinkThird Party AdvisoryVDB Entry
http://www.vupen.com/english/advisories/2009/3651Permissions RequiredVendor Advisory
http://blog.mybboard.net/2009/12/29/mybb-1-4-11-released-minor-patch-security-upRelease Notes
http://dev.mybboard.net/issues/617Broken Link
http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.Broken LinkExploit
http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.Broken LinkExploit

FAQ

What is CVE-2009-4449?

CVE-2009-4449 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Directory traversal vulnerability in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, when changing the user avatar from the gallery, allows remote authenticated users to determine th...

How severe is CVE-2009-4449?

CVE-2009-4449 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2009-4449?

Check the references section above for vendor advisories and patch information. Affected products include: Mybb Mybb.