RCE in Mybb
CVE-2022-39265
MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution (RCE). The vulnerable module requires Admin CP access with the `_Can manage settings?_` permission and may depend on configured file permissions. MyBB 1.8.31 resolves this issue with the commit `0cd318136a`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
EPSS: 0.022 (81.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Mybb — versions < 1.8.31
Weakness classification (CWE)
References
- security-advisories@github.com (Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory)
- security-advisories@github.com (Exploit, Third Party Advisory)
- security-advisories@github.com (Release Notes, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-39265?
- CVE-2022-39265 is a high-severity vulnerability in Mybb, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 7.2/10. Published 2022-10-06.
- How severe is CVE-2022-39265?
- High severity. CVSS v3 base score is 7.2 out of 10.