CVE-2023-46251
CVSS 3.1 Score 6.1 of 10 (medium)
Details
Summary
CVE-2023-46251 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting the MyBB forum software. The issue lies in the visual editor (_SCEditor_) where input is not properly escaped when rendering HTML. Maliciously crafted BBCode messages can exploit this weakness, allowing attackers to inject malicious scripts into a victim's browser. The vulnerability may be triggered on pages where message content is pre-filled through a GET/POST parameter or on reply pages that quote a previously saved malicious message. The impact can be mitigated by disabling the visual editor globally or for individual user accounts. MyBB version 1.8.37 resolves this issue with commit `6dcaf0b4d`. Users are advised to upgrade or disable the visual editor and the account option "Show the MyCode formatting options on the posting pages" to prevent potential attacks.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- MyBB
Affected Vendors
- myBB
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions