CVE-2024-23336

MEDIUM EPSS 36.4%

Published May 1, 20242y ago · Modified Jun 17, 20262w ago

5.0 CVSS 3.1

Medium

Published May 1, 2024 2y ago

Last Modified Jun 17, 2026 2w ago

Description

MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's _Disallowed Remote Addresses_ list (`$config['disallowed_remote_addresses']`) contains the address `127.0.0.1`, but does not include the complete block `127.0.0.0/8`. MyBB 1.8.38 resolves this issue in default installations. Administrators of installed boards should update the existing configuration (`inc/config.php`) to include all addresses blocked by default. Additionally, users are advised to verify that it includes any other IPv4 addresses resolving to the server and other internal resources. Users unable to upgrade may manually add 127.0.0.0/8' to their disallowed address list.

CVSS Details

Base Score

5.0

Exploitability

1.6

Impact

3.4

Vector string

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector Network

Attack Complexity High

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality Low

Integrity Low

Availability Low

Threat Intelligence

EPSS Exploit Probability

36.4% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 2

CWE-184

CWE-918 Server-Side Request Forgery (SSRF) Validation

Affected Products 1

Vendor	Product	Version	Range
mybb	mybb	*	<1.8.38

References 4

docs.mybb.com https://docs.mybb.com/1.8/administration/configuration-file

Product
github.com https://github.com/mybb/mybb/commit/d6a96019025de9149014e06b1df252e6122e5630

Patch
github.com https://github.com/mybb/mybb/security/advisories/GHSA-qfrj-65mv-h75h

Vendor Advisory
mybb.com https://mybb.com/versions/1.8.38

ProductRelease Notes

Remediation

github.com https://github.com/mybb/mybb/commit/d6a96019025de9149014e06b1df252e6122e5630

Patch