CVE-2022-39265

High

Description

MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution (RCE). The vulnerable module requires Admin CP access with the `_Can manage settings?_` permission and may depend on configured file permissions. MyBB 1.8.31 resolves this issue with the commit `0cd318136a`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

SeverityHigh

CVSS7.2

Exploit probability—

Product

Mybb

PublishedOct 6, 2022

First seenOct 6, 2022

Weakness typeCWE-74Injection

How to fix

Update

mybb mybb1.8.31 or later

Affected products

Product	Affected versions	Fixed in
mybb mybb	v < 1.8.31	1.8.31

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.