Vulnerability Description
MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allow remote attackers to have unspecified impact via vectors related to "loose comparison false positives."
CVSS Score
9.8
CRITICAL
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mybb | Merge System | <= 1.8.7 |
| Mybb | Mybb | <= 1.8.7 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2016/11/10/8Mailing ListPatchThird Party Advisory
- http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing ListPatchThird Party Advisory
- http://www.securityfocus.com/bid/94396Third Party AdvisoryVDB Entry
- https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/PatchRelease NotesVendor Advisory
- http://www.openwall.com/lists/oss-security/2016/11/10/8Mailing ListPatchThird Party Advisory
- http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing ListPatchThird Party Advisory
- http://www.securityfocus.com/bid/94396Third Party AdvisoryVDB Entry
- https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/PatchRelease NotesVendor Advisory
FAQ
What is CVE-2016-9420?
CVE-2016-9420 is a vulnerability with a CVSS score of 9.8 (CRITICAL). MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allow remote attackers to have unspecified impact via vectors related to "loose comparison false positives."
How severe is CVE-2016-9420?
CVE-2016-9420 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2016-9420?
Check the references section above for vendor advisories and patch information. Affected products include: Mybb Merge System, Mybb Mybb.