Vulnerability Description
MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vectors related to "style import."
CVSS Score
7.5
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mybb | Merge System | <= 1.8.7 |
| Mybb | Mybb | <= 1.8.7 |
| Microsoft | Windows | All versions |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2016/11/10/8Mailing ListPatchThird Party Advisory
- http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing ListPatchThird Party Advisory
- http://www.securityfocus.com/bid/94396Third Party AdvisoryVDB Entry
- https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/PatchRelease NotesVendor Advisory
- http://www.openwall.com/lists/oss-security/2016/11/10/8Mailing ListPatchThird Party Advisory
- http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing ListPatchThird Party Advisory
- http://www.securityfocus.com/bid/94396Third Party AdvisoryVDB Entry
- https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/PatchRelease NotesVendor Advisory
FAQ
What is CVE-2016-9415?
CVE-2016-9415 is a vulnerability with a CVSS score of 7.5 (HIGH). MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vectors related to "style import."
How severe is CVE-2016-9415?
CVE-2016-9415 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-9415?
Check the references section above for vendor advisories and patch information. Affected products include: Mybb Merge System, Mybb Mybb, Microsoft Windows.