What is CVE-2021-43281?

CVE-2021-43281 is a high-severity vulnerability in Mybb, classified under Code Injection. CVSS score: 7.2/10. Published 2021-11-04.

How severe is CVE-2021-43281?

High severity. CVSS v3 base score is 7.2 out of 10.

RCE in Mybb

CVE-2021-43281

MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with PHP code, executed on Change Settings pages.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.013 (67.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Mybb
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

References

cve@mitre.org (x_refsource_CONFIRM, Patch, Third Party Advisory, Release Notes)

Frequently asked questions

What is CVE-2021-43281?: CVE-2021-43281 is a high-severity vulnerability in Mybb, classified under Code Injection. CVSS score: 7.2/10. Published 2021-11-04.
How severe is CVE-2021-43281?: High severity. CVSS v3 base score is 7.2 out of 10.