GSD-2022-39265

Vulnerability from gsd - Updated: 2023-12-13 01:19
Details
MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution (RCE). The vulnerable module requires Admin CP access with the `_Can manage settings?_` permission and may depend on configured file permissions. MyBB 1.8.31 resolves this issue with the commit `0cd318136a`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Aliases
Aliases
CVE-2022-39265
To clipboard 

{
  "GSD": {
    "alias": "CVE-2022-39265",
    "description": "MyBB is a free and open source forum software. The _Mail Settings_ \u2192 Additional Parameters for PHP\u0027s mail() function mail_parameters setting value, in connection with the configured mail program\u0027s options and behavior, may allow access to sensitive information and Remote Code Execution (RCE). The vulnerable module requires Admin CP access with the `_Can manage settings?_` permission and may depend on configured file permissions. MyBB 1.8.31 resolves this issue with the commit `0cd318136a`. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
    "id": "GSD-2022-39265"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-39265"
      ],
      "details": "MyBB is a free and open source forum software. The _Mail Settings_ \u2192 Additional Parameters for PHP\u0027s mail() function mail_parameters setting value, in connection with the configured mail program\u0027s options and behavior, may allow access to sensitive information and Remote Code Execution (RCE). The vulnerable module requires Admin CP access with the `_Can manage settings?_` permission and may depend on configured file permissions. MyBB 1.8.31 resolves this issue with the commit `0cd318136a`. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
      "id": "GSD-2022-39265",
      "modified": "2023-12-13T01:19:20.709607Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2022-39265",
        "STATE": "PUBLIC",
        "TITLE": "Mail settings\u0027 command parameter injection in mybb"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "mybb",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003c 1.8.31"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "mybb"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "MyBB is a free and open source forum software. The _Mail Settings_ \u2192 Additional Parameters for PHP\u0027s mail() function mail_parameters setting value, in connection with the configured mail program\u0027s options and behavior, may allow access to sensitive information and Remote Code Execution (RCE). The vulnerable module requires Admin CP access with the `_Can manage settings?_` permission and may depend on configured file permissions. MyBB 1.8.31 resolves this issue with the commit `0cd318136a`. Users are advised to upgrade. There are no known workarounds for this vulnerability."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/mybb/mybb/security/advisories/GHSA-hxhm-rq9f-7xj7",
            "refsource": "CONFIRM",
            "url": "https://github.com/mybb/mybb/security/advisories/GHSA-hxhm-rq9f-7xj7"
          },
          {
            "name": "https://github.com/mybb/mybb/commit/0cd318136a10b029bb5c8a8f6dddf39d87519797",
            "refsource": "MISC",
            "url": "https://github.com/mybb/mybb/commit/0cd318136a10b029bb5c8a8f6dddf39d87519797"
          },
          {
            "name": "https://github.com/mybb/mybb/blob/mybb_1830/install/resources/settings.xml#L2331-L2338",
            "refsource": "MISC",
            "url": "https://github.com/mybb/mybb/blob/mybb_1830/install/resources/settings.xml#L2331-L2338"
          },
          {
            "name": "https://mybb.com/versions/1.8.31/",
            "refsource": "MISC",
            "url": "https://mybb.com/versions/1.8.31/"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-hxhm-rq9f-7xj7",
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.8.31",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-39265"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "MyBB is a free and open source forum software. The _Mail Settings_ ? Additional Parameters for PHP\u0027s mail() function mail_parameters setting value, in connection with the configured mail program\u0027s options and behavior, may allow access to sensitive information and Remote Code Execution (RCE). The vulnerable module requires Admin CP access with the `_Can manage settings?_` permission and may depend on configured file permissions. MyBB 1.8.31 resolves this issue with the commit `0cd318136a`. Users are advised to upgrade. There are no known workarounds for this vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-74"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://mybb.com/versions/1.8.31/",
              "refsource": "MISC",
              "tags": [
                "Release Notes",
                "Vendor Advisory"
              ],
              "url": "https://mybb.com/versions/1.8.31/"
            },
            {
              "name": "https://github.com/mybb/mybb/security/advisories/GHSA-hxhm-rq9f-7xj7",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/mybb/mybb/security/advisories/GHSA-hxhm-rq9f-7xj7"
            },
            {
              "name": "https://github.com/mybb/mybb/commit/0cd318136a10b029bb5c8a8f6dddf39d87519797",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/mybb/mybb/commit/0cd318136a10b029bb5c8a8f6dddf39d87519797"
            },
            {
              "name": "https://github.com/mybb/mybb/blob/mybb_1830/install/resources/settings.xml#L2331-L2338",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://github.com/mybb/mybb/blob/mybb_1830/install/resources/settings.xml#L2331-L2338"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.2,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2023-03-01T18:08Z",
      "publishedDate": "2022-10-06T18:16Z"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.