CVE-2023-45556 - Vulnerability Details - OpenCVE

Cross Site Scripting vulnerability in Mybb Mybb Forums v.1.8.33 allows a local attacker to execute arbitrary code via the theme Name parameter in the theme management component.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Mybb	Mybb

Configuration 1 [-]

cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/Or4ngm4n/Mybb/blob/main/MyBB%201.8.33%20Cross%20Site%20Scripting.txt
https://github.com/mybb/mybb/security/advisories/GHSA-4xqm-3cm2-5xgf
https://raw.githubusercontent.com/Or4ngm4n/Mybb/main/Screenshot%202023-10-08%20012112.png

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-11-06T00:00:00

Updated: 2024-09-05T14:16:56.909Z

Reserved: 2023-10-09T00:00:00

Link: CVE-2023-45556

Vulnrichment

Updated: 2024-08-02T20:21:16.660Z

NVD

Status : Modified

Published: 2023-11-06T22:15:07.990

Modified: 2024-11-21T08:26:57.797

Link: CVE-2023-45556

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*", "matchCriteriaId": "EC8DBC6D-0D47-46D6-A840-36BF42F37437", "versionEndExcluding": "1.8.37", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Cross Site Scripting vulnerability in Mybb Mybb Forums v.1.8.33 allows a local attacker to execute arbitrary code via the theme Name parameter in the theme management component."}, {"lang": "es", "value": "Vulnerabilidad de Cross-Site Scripting (XSS) en Mybb Mybb Forums v.1.8.33 permite a un atacante local ejecutar c\u00f3digo arbitrario a trav\u00e9s del par\u00e1metro Nombre del tema en el componente de administraci\u00f3n de temas."}], "id": "CVE-2023-45556", "lastModified": "2024-11-21T08:26:57.797", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-11-06T22:15:07.990", "references": [{"source": "cve@mitre.org", "tags": ["Exploit"], "url": "https://github.com/Or4ngm4n/Mybb/blob/main/MyBB%201.8.33%20Cross%20Site%20Scripting.txt"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/mybb/mybb/security/advisories/GHSA-4xqm-3cm2-5xgf"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://raw.githubusercontent.com/Or4ngm4n/Mybb/main/Screenshot%202023-10-08%20012112.png"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "https://github.com/Or4ngm4n/Mybb/blob/main/MyBB%201.8.33%20Cross%20Site%20Scripting.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/mybb/mybb/security/advisories/GHSA-4xqm-3cm2-5xgf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://raw.githubusercontent.com/Or4ngm4n/Mybb/main/Screenshot%202023-10-08%20012112.png"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}