Improper input validation in Mybb

CVE-2008-4930

MyBB (aka MyBulletinBoard) 1.4.2 does not properly handle an uploaded file with a nonstandard file type that contains HTML sequences, which allows remote attackers to cause that file to be processed as HTML by Internet Explorer's content inspection, aka "Incomplete protection against MIME-sniffing." NOTE: this could be leveraged for XSS and other attacks.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.012 (63.7th percentile) — read the EPSS interpretation.

Affected products

  • Mybb — versions 1.4.2
  • N/a — versions n/a

Weakness classification (CWE)

References