CVE-2015-8973

high

Description

xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password.

References

Advisories
More

http://www.securityfocus.com/bid/94397

http://www.openwall.com/lists/oss-security/2016/11/18/1

http://www.openwall.com/lists/oss-security/2016/11/10/8

https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/

Details

Source: Mitre, NVD

Published: 2017-01-31

Updated: 2026-05-13

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 8.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L