VulnerabilityModified
CVE-2021-43281
MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission.
HIGH 7.2EPSS 1.33%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.33%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with PHP code, executed on Change Settings pages.
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.33% probability · 70th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- mybb/mybb
- Source
- cve@mitre.org
References
- https://github.com/mybb/mybb/security/advisories/GHSA-8gxx-vmr9-h39pPatch, Release Notes, Third Party Advisory
- https://github.com/mybb/mybb/security/advisories/GHSA-8gxx-vmr9-h39pPatch, Release Notes, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.