CVE-2016-9412 MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow attackers to have unspecified impact via vectors related to low adminsid and sid entropy.
CriticalCVSS 9.8
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow attackers to have unspecified impact via vectors related to low adminsid and sid entropy.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mybb merge system | <= 1.8.6 | No fix listed |
| mybb | <= 1.8.6 | No fix listed |
References
- [oss-security] 20161110 CVE request: MyBB multiple vulnerabilities mailing-list patch third-party-advisory
- [oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities mailing-list patch third-party-advisory
- 94395 third-party-advisory vdb-entry
- blog.mybb.com patch release-notes vendor-advisory