CVE-2008-7082
- State
- Published
- Severity
- Not scored
- Published
- Aug 25, 2009
- Updated
- Aug 7, 2024
- Reserved
- Aug 24, 2009
Description
MyBB (aka MyBulletinBoard) 1.4.3 includes the sensitive my_post_key parameter in URLs to moderation.php with the (1) mergeposts, (2) split, and (3) deleteposts actions, which allows remote attackers to steal the token and bypass the cross-site request forgery (CSRF) protection mechanism to hijack the authentication of moderators by reading the token from the HTTP Referer header.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 20081125 MyBB 1.4.3 my_post_key Disclosure Vulnerabilitymailing-list
- 32467vdb-entry
- 32880third-party-advisory
- mybb-mypostkey-weak-security(46885)vdb-entry
- 50275vdb-entry
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.