CVE-2021-27279 - OpenCVE

MyBB before 1.8.25 allows stored XSS via nested [email] tags with MyCode (aka BBCode).

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:S/C:N/I:P/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Mybb	Mybb

Configuration 1 [-]

cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*

References

Link	Resource
https://github.com/mybb/mybb/commit/cb781b49116bf5c4d8deca3e17498122b701677a	Patch Third Party Advisory
https://github.com/mybb/mybb/security/advisories/GHSA-6483-hcpp-p75w	Exploit Third Party Advisory
https://mybb.com/versions/1.8.25/	Release Notes Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: mitre

Published: 2021-02-22T19:04:20

Updated: 2021-02-22T19:04:20

Reserved: 2021-02-16T00:00:00

Link: CVE-2021-27279

JSON object: View

NVD Information

Status : Analyzed

Published: 2021-02-22T20:15:13.243

Modified: 2021-02-26T15:37:45.260

Link: CVE-2021-27279

JSON object: View

Redhat Information

No data.

CWE

CWE-79

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*", "matchCriteriaId": "F8B31EA3-CFEA-43B3-8348-397BED3FD568", "versionEndExcluding": "1.8.25", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "MyBB before 1.8.25 allows stored XSS via nested [email] tags with MyCode (aka BBCode)."}, {"lang": "es", "value": "MyBB versiones anteriores a 1.8.25, permite un ataque de tipo XSS almacenado por medio de etiquetas [correo electr\u00f3nico] anidadas con MyCode (tambi\u00e9n se conoce como BBCode)"}], "id": "CVE-2021-27279", "lastModified": "2021-02-26T15:37:45.260", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-02-22T20:15:13.243", "references": [{"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/mybb/mybb/commit/cb781b49116bf5c4d8deca3e17498122b701677a"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/mybb/mybb/security/advisories/GHSA-6483-hcpp-p75w"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://mybb.com/versions/1.8.25/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}