CVE-2008-4930
MyBB (aka MyBulletinBoard) 1.4.2 does not properly handle an uploaded file with a nonstandard file type that contains HTML sequences, which allows remote attackers to cause that file to be processed as HTML by Internet Explorer's content inspection, aka…
Does this matter?
Lower severity and a low EPSS score (1.15%). Track it; it rarely justifies an emergency change on its own.
Description
MyBB (aka MyBulletinBoard) 1.4.2 does not properly handle an uploaded file with a nonstandard file type that contains HTML sequences, which allows remote attackers to cause that file to be processed as HTML by Internet Explorer's content inspection, aka "Incomplete protection against MIME-sniffing." NOTE: this could be leveraged for XSS and other attacks.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
- EPSS
- 1.15% probability · 65th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- mybb/mybb
- Source
- cve@mitre.org
References
- http://archives.neohapsis.com/archives/bugtraq/2008-10/0203.html
- http://archives.neohapsis.com/archives/fulldisclosure/2008-10/0472.html
- http://www.openwall.com/lists/oss-security/2008/11/01/2
- http://archives.neohapsis.com/archives/bugtraq/2008-10/0203.html
- http://archives.neohapsis.com/archives/fulldisclosure/2008-10/0472.html
- http://www.openwall.com/lists/oss-security/2008/11/01/2
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.