CVE-2024-23336
What it is
MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's _Disallowed Remote Addresses_ list (`$config['disallowed_remote_addresses']`) contains the address `127.0.0.1`, but does not include the complete block `127.0.0.0/8`. MyBB 1.8.38 resolves this issue in default installations. Administrators of installed boards should update the existing configuration (`inc/config.php`) to include all addresses blocked by default. Additionally, users are advised to verify that it includes any other IPv4 addresses resolving to the server and other internal resources. Users unable to upgrade may manually add 127.0.0.0/8' to their disallowed address list.
At a glance
- Exploitability
- Can be exploited over the network with a low-privilege account. Limited direct impact.
- Exploit odds
- 0.5% chance of exploitation in the next 30 days (EPSS).
- Fix
- A patch, advisory or fixed version is referenced. Upgrade or apply it.
Timeline
- PublishedDisclosed publicly on CVE.org and NVD
- Last updatedMost recent change to the record
Why it ranks here
- Exploited in the wild: no, CISA does not list it.
- Exploit odds: 0.5% in the next 30 days (EPSS).
- Severity: 5.0 MEDIUM (CVSS).
- Fix: a patch or advisory is linked.
Details
- Published
- Last modified
- Exploit probability
- 0.5% · EPSS, next 30 days
- Weakness
- CWE-184
- Record status
- Analyzed
Affected
- Mybb < 1.8.38
Attack profile CVSS 3.1 · 5.0
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Raw vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Is it in your code?
Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.
Read https://cve-list.com/agent/cve/CVE-2024-23336.md and follow it. Check whether this project is affected by CVE-2024-23336. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.
Fix and advisories
- https://github.com/mybb/mybb/commit/d6a96019025de9149014e06b1df252e6122e5630
- https://github.com/mybb/mybb/security/advisories/GHSA-qfrj-65mv-h75h
- https://github.com/mybb/mybb/commit/d6a96019025de9149014e06b1df252e6122e5630
- https://github.com/mybb/mybb/security/advisories/GHSA-qfrj-65mv-h75h
References
- https://docs.mybb.com/1.8/administration/configuration-file
- https://github.com/mybb/mybb/commit/d6a96019025de9149014e06b1df252e6122e5630
- https://github.com/mybb/mybb/security/advisories/GHSA-qfrj-65mv-h75h
- https://mybb.com/versions/1.8.38
- https://docs.mybb.com/1.8/administration/configuration-file
- https://github.com/mybb/mybb/commit/d6a96019025de9149014e06b1df252e6122e5630
- https://github.com/mybb/mybb/security/advisories/GHSA-qfrj-65mv-h75h
- https://mybb.com/versions/1.8.38