CVE-2008-4929

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2008-4929
MyBB (aka MyBulletinBoard) 1.4.2 uses insufficient randomness to compose filenames of uploaded files used as attachments, which makes it easier for remote attackers to read these files by guessing filenames.

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://archives.neohapsis.com/archives/bugtraq/2008-10/0203.html Broken Link Exploit
http://archives.neohapsis.com/archives/bugtraq/2008-10/0203.html Broken Link Exploit
http://archives.neohapsis.com/archives/fulldisclosure/2008-10/0472.html Broken Link Exploit
http://archives.neohapsis.com/archives/fulldisclosure/2008-10/0472.html Broken Link Exploit
http://www.openwall.com/lists/oss-security/2008/11/01/2 Exploit Mailing List
http://www.openwall.com/lists/oss-security/2008/11/01/2 Exploit Mailing List
http://www.securityfocus.com/bid/31936 Broken Link Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/31936 Broken Link Third Party Advisory VDB Entry
http://www.vupen.com/english/advisories/2008/2967 Broken Link
http://www.vupen.com/english/advisories/2008/2967 Broken Link
Configurations

Configuration 1 (hide)

cpe:2.3:a:mybb:mybb:1.4.2:*:*:*:*:*:*:*
History

17 Jan 2025, 16:15

Type Values Removed Values Added
References (BID) http://www.securityfocus.com/bid/31936 - Broken Link, Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/31936 - Broken Link, Third Party Advisory, VDB Entry
References (MLIST) http://www.openwall.com/lists/oss-security/2008/11/01/2 - Exploit, Mailing List () http://www.openwall.com/lists/oss-security/2008/11/01/2 - Exploit, Mailing List
References (VUPEN) http://www.vupen.com/english/advisories/2008/2967 - Broken Link () http://www.vupen.com/english/advisories/2008/2967 - Broken Link
References (FULLDISC) http://archives.neohapsis.com/archives/fulldisclosure/2008-10/0472.html - Broken Link, Exploit () http://archives.neohapsis.com/archives/fulldisclosure/2008-10/0472.html - Broken Link, Exploit
References (BUGTRAQ) http://archives.neohapsis.com/archives/bugtraq/2008-10/0203.html - Broken Link, Exploit () http://archives.neohapsis.com/archives/bugtraq/2008-10/0203.html - Broken Link, Exploit

14 Feb 2024, 16:09

Type Values Removed Values Added
CWE CWE-310 CWE-330
CVSS v2 : 5.0
v3 : unknown 		v2 : 5.0
v3 : 7.5
References (BUGTRAQ) http://archives.neohapsis.com/archives/bugtraq/2008-10/0203.html - Exploit (BUGTRAQ) http://archives.neohapsis.com/archives/bugtraq/2008-10/0203.html - Broken Link, Exploit
References (VUPEN) http://www.vupen.com/english/advisories/2008/2967 - (VUPEN) http://www.vupen.com/english/advisories/2008/2967 - Broken Link
References (MLIST) http://www.openwall.com/lists/oss-security/2008/11/01/2 - Exploit (MLIST) http://www.openwall.com/lists/oss-security/2008/11/01/2 - Exploit, Mailing List
References (BID) http://www.securityfocus.com/bid/31936 - (BID) http://www.securityfocus.com/bid/31936 - Broken Link, Third Party Advisory, VDB Entry
References (FULLDISC) http://archives.neohapsis.com/archives/fulldisclosure/2008-10/0472.html - Exploit (FULLDISC) http://archives.neohapsis.com/archives/fulldisclosure/2008-10/0472.html - Broken Link, Exploit
Information

Published : 2008-11-04 21:00

Updated : 2025-01-17 16:15

NVD link : CVE-2008-4929

Mitre link : CVE-2008-4929

JSON object : View

Products Affected

mybb

  • mybb
CWE
CWE-330

Use of Insufficiently Random Values