CVE-2016-9417
HighSummary
The fetch_remote_file function in MyBB before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.
Risk Assessment
SSRF attacks can lead to unauthorized access to internal server resources, posing a serious threat to the organization's data security.
Recommendation
It is recommended to update MyBB to version 1.8.8 or later to mitigate this vulnerability.
Other vulnerabilities in MyBB, MyBB Merge System
See all- CVE-2016-9418High
MyBB before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information from ACP backups via vectors involving a short name.
- CVE-2016-9415High
MyBB before version 1.8.8 on Windows and MyBB Merge System before version 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vectors related to 'style import.'
- CVE-2016-9414High
MyBB before version 1.8.7 and MyBB Merge System before version 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload directories.
- CVE-2016-9410High
MyBB (also known as MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors involving templates.
- CVE-2015-8977High
MyBB before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.
- CVE-2016-9420Critical
MyBB before version 1.8.8 and MyBB Merge System before version 1.8.8 have a vulnerability that allows remote attackers to achieve unspecified impact via vectors related to 'loose comparison false positives'.
- CVE-2016-9412Critical
MyBB before version 1.8.7 and MyBB Merge System before version 1.8.7 have a vulnerability that allows attackers to achieve unspecified impact via vectors related to low adminsid and sid entropy.
Original NVD description (English source)
The fetch_remote_file function in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.