CVE-2024-23335

Backups directory .htaccess deletion in. MyBB

State: Published
Severity: 4.7 Medium
Published: May 1, 2024
Updated: Aug 1, 2024
Reserved: Jan 15, 2024

Description

MyBB is a free and open source forum software. The backup management module of the Admin CP may accept `.htaccess` as the name of the backup file to be deleted, which may expose the stored backup files over HTTP on Apache servers. MyBB 1.8.38 resolves this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability

Scores

CVSS	Score	Vector	Source
3.1	4.7 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L	GitHub_M

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
mybbmybb	< 1.8.38Affected

References

https://github.com/mybb/mybb/security/advisories/GHSA-94xr-g4ww-j47r
https://github.com/mybb/mybb/commit/450259e501b94c9d483efb167cb2bf875605e111.patch
https://mybb.com/versions/1.8.38

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.