CVE-2019-12363

Опубликовано: 11 июл. 2019

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB. An attacker can forge a request to an installed mybb2fa plugin to control its state via usercp.php?action=mybb2fa&do=deactivate (or usercp.php?action=mybb2fa&do=activate). A deactivate operation lowers the security of the targeted account by disabling two factor authentication.

Ссылки

https://community.mybb.com/thread-162369.html
Issue Tracking
Third Party Advisory
https://seekurity.com/blog/advisories/mybb-two-factor-authentication-extension-vulnerabilities/
Exploit
Third Party Advisory
https://community.mybb.com/thread-162369.html
Issue Tracking
Third Party Advisory
https://seekurity.com/blog/advisories/mybb-two-factor-authentication-extension-vulnerabilities/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:mybb-2fa_project:mybb-2fa:*:*:*:*:*:mybb:*:*

Версия до 2014-11-05 (включая)

EPSS

Процентиль: 24%

0.00083

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-cp4x-gprf-24pm