CVE-2018-11092

Опубликовано: 21 мая 2018

Источник: nvd

CVSS3: 6.5

CVSS2: 5.8

EPSS Низкий

Описание

An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/index.php?empty=table (aka Clear Table) action.

Ссылки

https://community.mybb.com/mods.php?action=changelog&pid=1106
Release Notes
Third Party Advisory
https://github.com/vintagedaddyo/MyBB_Plugin-adminnotes/commit/3deae701cdd89753cb6688302aee5b93a72bc58b?diff=split
Patch
Third Party Advisory
https://www.exploit-db.com/exploits/44624/
Exploit
Third Party Advisory
VDB Entry
https://community.mybb.com/mods.php?action=changelog&pid=1106
Release Notes
Third Party Advisory
https://github.com/vintagedaddyo/MyBB_Plugin-adminnotes/commit/3deae701cdd89753cb6688302aee5b93a72bc58b?diff=split
Patch
Third Party Advisory
https://www.exploit-db.com/exploits/44624/
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:admin_notes_project:admin_notes:1.1:*:*:*:*:mybb:*:*

EPSS

Процентиль: 42%

0.00197

Низкий

6.5 Medium

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-phjp-gxh4-rcjp