CVE-2023-46251 (GCVE-0-2023-46251)

Vulnerability from cvelistv5 – Published: 2023-11-06 17:41 – Updated: 2024-09-04 19:32
VLAI
Title
Visual editor persistent Cross-site Scripting (XSS) in MyBB
Summary
MyBB is a free and open source forum software. Custom MyCode (BBCode) for the visual editor (_SCEditor_) doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as a post or Private Message) and operates on a maliciously crafted MyCode message. This may occur on pages where message content is pre-filled using a GET/POST parameter, or on reply pages where a previously saved malicious message is quoted. The impact is be mitigated when: 1. the visual editor is disabled globally (_Admin CP → Configuration → Settings → Clickable Smilies and BB Code: [Clickable MyCode Editor](https://github.com/mybb/mybb/blob/mybb_1836/install/resources/settings.xml#L2087-L2094)_ is set to _Off_), or 2. the visual editor is disabled for individual user accounts (_User CP → Your Profile → Edit Options_: _Show the MyCode formatting options on the posting pages_ checkbox is not checked). MyBB 1.8.37 resolves this issue with the commit `6dcaf0b4d`. Users are advised to upgrade. Users unable to upgrade may mitigate the impact without upgrading MyBB by changing the following setting (_Admin CP → Configuration → Settings_): - _Clickable Smilies and BB Code → [Clickable MyCode Editor](https://github.com/mybb/mybb/blob/mybb_1836/install/resources/settings.xml#L2087-L2094)_: _Off_. Similarly, individual MyBB forum users are able to disable the visual editor by diabling the account option (_User CP → Your Profile → Edit Options_) _Show the MyCode formatting options on the posting pages_.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-04 19:26 UTC
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version CPE status
mybb mybb Affected: < 1.8.37
guessed Create a notification for this product.
mybb mybb Affected: 0 , < 1.8.37 (custom)
    cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:37:40.233Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/mybb/mybb/security/advisories/GHSA-wj33-q7vj-9fr8",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/mybb/mybb/security/advisories/GHSA-wj33-q7vj-9fr8"
          },
          {
            "name": "https://github.com/mybb/mybb/commit/6dcaf0b4db6254f1833fe8dae295d9ddc2219276",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mybb/mybb/commit/6dcaf0b4db6254f1833fe8dae295d9ddc2219276"
          },
          {
            "name": "https://mybb.com/versions/1.8.37/",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://mybb.com/versions/1.8.37/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "mybb",
            "vendor": "mybb",
            "versions": [
              {
                "lessThan": "1.8.37",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-46251",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-04T19:26:53.568111Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-04T19:32:41.984Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mybb",
          "vendor": "mybb",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.8.37"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": " MyBB is a free and open source forum software. Custom MyCode (BBCode) for the visual editor (_SCEditor_) doesn\u0027t escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as a post or Private Message) and operates on a maliciously crafted MyCode message. This may occur on pages where message content is pre-filled using a GET/POST parameter, or on reply pages where a previously saved malicious message is quoted. The impact is be mitigated when: 1. the visual editor is disabled globally (_Admin CP \u2192 Configuration \u2192 Settings \u2192 Clickable Smilies and BB Code: [Clickable MyCode Editor](https://github.com/mybb/mybb/blob/mybb_1836/install/resources/settings.xml#L2087-L2094)_ is set to _Off_), or 2. the visual editor is disabled for individual user accounts (_User CP \u2192 Your Profile \u2192 Edit Options_: _Show the MyCode formatting options on the posting pages_ checkbox is not checked). MyBB 1.8.37 resolves this issue with the commit `6dcaf0b4d`. Users are advised to upgrade. Users unable to upgrade may mitigate the impact without upgrading MyBB by changing the following setting (_Admin CP \u2192 Configuration \u2192 Settings_):\n- _Clickable Smilies and BB Code \u2192 [Clickable MyCode Editor](https://github.com/mybb/mybb/blob/mybb_1836/install/resources/settings.xml#L2087-L2094)_: _Off_. Similarly, individual MyBB forum users are able to disable the visual editor by diabling the account option (_User CP \u2192 Your Profile \u2192 Edit Options_) _Show the MyCode formatting options on the posting pages_."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-06T17:41:30.378Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mybb/mybb/security/advisories/GHSA-wj33-q7vj-9fr8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mybb/mybb/security/advisories/GHSA-wj33-q7vj-9fr8"
        },
        {
          "name": "https://github.com/mybb/mybb/commit/6dcaf0b4db6254f1833fe8dae295d9ddc2219276",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mybb/mybb/commit/6dcaf0b4db6254f1833fe8dae295d9ddc2219276"
        },
        {
          "name": "https://mybb.com/versions/1.8.37/",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://mybb.com/versions/1.8.37/"
        }
      ],
      "source": {
        "advisory": "GHSA-wj33-q7vj-9fr8",
        "discovery": "UNKNOWN"
      },
      "title": "Visual editor persistent Cross-site Scripting (XSS) in MyBB"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-46251",
    "datePublished": "2023-11-06T17:41:30.378Z",
    "dateReserved": "2023-10-19T20:34:00.948Z",
    "dateUpdated": "2024-09-04T19:32:41.984Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-46251",
      "date": "2026-09-21",
      "epss": "0.00471",
      "percentile": "0.39764"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "EC8DBC6D-0D47-46D6-A840-36BF42F37437",
                  "versionEndExcluding": "1.8.37",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": " MyBB is a free and open source forum software. Custom MyCode (BBCode) for the visual editor (_SCEditor_) doesn\u0027t escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as a post or Private Message) and operates on a maliciously crafted MyCode message. This may occur on pages where message content is pre-filled using a GET/POST parameter, or on reply pages where a previously saved malicious message is quoted. The impact is be mitigated when: 1. the visual editor is disabled globally (_Admin CP \u2192 Configuration \u2192 Settings \u2192 Clickable Smilies and BB Code: [Clickable MyCode Editor](https://github.com/mybb/mybb/blob/mybb_1836/install/resources/settings.xml#L2087-L2094)_ is set to _Off_), or 2. the visual editor is disabled for individual user accounts (_User CP \u2192 Your Profile \u2192 Edit Options_: _Show the MyCode formatting options on the posting pages_ checkbox is not checked). MyBB 1.8.37 resolves this issue with the commit `6dcaf0b4d`. Users are advised to upgrade. Users unable to upgrade may mitigate the impact without upgrading MyBB by changing the following setting (_Admin CP \u2192 Configuration \u2192 Settings_):\n- _Clickable Smilies and BB Code \u2192 [Clickable MyCode Editor](https://github.com/mybb/mybb/blob/mybb_1836/install/resources/settings.xml#L2087-L2094)_: _Off_. Similarly, individual MyBB forum users are able to disable the visual editor by diabling the account option (_User CP \u2192 Your Profile \u2192 Edit Options_) _Show the MyCode formatting options on the posting pages_."
        },
        {
          "lang": "es",
          "value": "MyBB es un software de foro gratuito y de c\u00f3digo abierto. El MyCode personalizado (BBCode) para el editor visual (_SCEditor_) no sanitiza la entrada correctamente al representar HTML, lo que genera una vulnerabilidad XSS basada en DOM. Esta debilidad se puede explotar dirigiendo a la v\u00edctima a una p\u00e1gina donde el editor visual est\u00e1 activo (por ejemplo, como una publicaci\u00f3n o mensaje privado) y opera con un mensaje MyCode creado con fines malintencionados. Esto puede ocurrir en p\u00e1ginas donde el contenido del mensaje se completa previamente mediante un par\u00e1metro GET/POST, o en p\u00e1ginas de respuesta donde se cita un mensaje malicioso previamente guardado. El impacto se mitiga cuando: \n1. el editor visual est\u00e1 deshabilitado globalmente (_Admin CP ? Configuration ? Settings ? Clickable Smilies and BB Code: [Clickable MyCode Editor](https://github.com/mybb/mybb/blob/mybb_1836/install/resources/settings.xml#L2087-L2094)_ is set to _Off_), o \n2. el editor visual est\u00e1 deshabilitado para cuentas de usuario individuales (_User CP ? Your Profile ? Edit Options_: _Show the MyCode formatting options on the posting pages_ checkbox is not checked).\nMyBB 1.8.37 resuelve este problema con el commit `6dcaf0b4d`. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar pueden mitigar el impacto sin actualizar MyBB cambiando la siguiente configuraci\u00f3n (_Admin CP ? Configuration ? Settings_): - _Clickable Smilies and BB Code ? [Clickable MyCode Editor](https://github.com/mybb/mybb/blob/mybb_1836/install/resources/settings.xml#L2087-L2094)_: _Off_. \nDe manera similar, los usuarios individuales del foro MyBB pueden desactivar el editor visual marcando la opci\u00f3n de cuenta (_User CP ? Your Profile ? Edit Options_)_Show the MyCode formatting options on the posting pages_."
        }
      ],
      "id": "CVE-2023-46251",
      "lastModified": "2024-11-21T08:28:10.273",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.6,
            "impactScore": 5.9,
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 2.7,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2023-11-06T18:15:08.547",
      "references": [
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Patch"
          ],
          "url": "https://github.com/mybb/mybb/commit/6dcaf0b4db6254f1833fe8dae295d9ddc2219276"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://github.com/mybb/mybb/security/advisories/GHSA-wj33-q7vj-9fr8"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Release Notes"
          ],
          "url": "https://mybb.com/versions/1.8.37/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://github.com/mybb/mybb/commit/6dcaf0b4db6254f1833fe8dae295d9ddc2219276"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://github.com/mybb/mybb/security/advisories/GHSA-wj33-q7vj-9fr8"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Release Notes"
          ],
          "url": "https://mybb.com/versions/1.8.37/"
        }
      ],
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-79"
            }
          ],
          "source": "security-advisories@github.com",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "mybb",
                "vendor": "mybb",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.8.37"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "mybb",
                "vendor": "mybb",
                "versions": [
                  {
                    "lessThan": "1.8.37",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EC8DBC6D-0D47-46D6-A840-36BF42F37437",
                    "versionEndExcluding": "1.8.37",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": " MyBB is a free and open source forum software. Custom MyCode (BBCode) for the visual editor (_SCEditor_) doesn\u0027t escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as a post or Private Message) and operates on a maliciously crafted MyCode message. This may occur on pages where message content is pre-filled using a GET/POST parameter, or on reply pages where a previously saved malicious message is quoted. The impact is be mitigated when: 1. the visual editor is disabled globally (_Admin CP \u2192 Configuration \u2192 Settings \u2192 Clickable Smilies and BB Code: [Clickable MyCode Editor](https://github.com/mybb/mybb/blob/mybb_1836/install/resources/settings.xml#L2087-L2094)_ is set to _Off_), or 2. the visual editor is disabled for individual user accounts (_User CP \u2192 Your Profile \u2192 Edit Options_: _Show the MyCode formatting options on the posting pages_ checkbox is not checked). MyBB 1.8.37 resolves this issue with the commit `6dcaf0b4d`. Users are advised to upgrade. Users unable to upgrade may mitigate the impact without upgrading MyBB by changing the following setting (_Admin CP \u2192 Configuration \u2192 Settings_):\n- _Clickable Smilies and BB Code \u2192 [Clickable MyCode Editor](https://github.com/mybb/mybb/blob/mybb_1836/install/resources/settings.xml#L2087-L2094)_: _Off_. Similarly, individual MyBB forum users are able to disable the visual editor by diabling the account option (_User CP \u2192 Your Profile \u2192 Edit Options_) _Show the MyCode formatting options on the posting pages_."
          },
          {
            "lang": "es",
            "value": "MyBB es un software de foro gratuito y de c\u00f3digo abierto. El MyCode personalizado (BBCode) para el editor visual (_SCEditor_) no sanitiza la entrada correctamente al representar HTML, lo que genera una vulnerabilidad XSS basada en DOM. Esta debilidad se puede explotar dirigiendo a la v\u00edctima a una p\u00e1gina donde el editor visual est\u00e1 activo (por ejemplo, como una publicaci\u00f3n o mensaje privado) y opera con un mensaje MyCode creado con fines malintencionados. Esto puede ocurrir en p\u00e1ginas donde el contenido del mensaje se completa previamente mediante un par\u00e1metro GET/POST, o en p\u00e1ginas de respuesta donde se cita un mensaje malicioso previamente guardado. El impacto se mitiga cuando: \n1. el editor visual est\u00e1 deshabilitado globalmente (_Admin CP ? Configuration ? Settings ? Clickable Smilies and BB Code: [Clickable MyCode Editor](https://github.com/mybb/mybb/blob/mybb_1836/install/resources/settings.xml#L2087-L2094)_ is set to _Off_), o \n2. el editor visual est\u00e1 deshabilitado para cuentas de usuario individuales (_User CP ? Your Profile ? Edit Options_: _Show the MyCode formatting options on the posting pages_ checkbox is not checked).\nMyBB 1.8.37 resuelve este problema con el commit `6dcaf0b4d`. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar pueden mitigar el impacto sin actualizar MyBB cambiando la siguiente configuraci\u00f3n (_Admin CP ? Configuration ? Settings_): - _Clickable Smilies and BB Code ? [Clickable MyCode Editor](https://github.com/mybb/mybb/blob/mybb_1836/install/resources/settings.xml#L2087-L2094)_: _Off_. \nDe manera similar, los usuarios individuales del foro MyBB pueden desactivar el editor visual marcando la opci\u00f3n de cuenta (_User CP ? Your Profile ? Edit Options_)_Show the MyCode formatting options on the posting pages_."
          }
        ],
        "id": "CVE-2023-46251",
        "lastModified": "2026-06-17T06:30:31.310",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 5.9,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-46251",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-04T19:26:53.568111Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2023-11-06T18:15:08.547",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/mybb/mybb/commit/6dcaf0b4db6254f1833fe8dae295d9ddc2219276"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/mybb/mybb/security/advisories/GHSA-wj33-q7vj-9fr8"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://mybb.com/versions/1.8.37/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/mybb/mybb/commit/6dcaf0b4db6254f1833fe8dae295d9ddc2219276"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/mybb/mybb/security/advisories/GHSA-wj33-q7vj-9fr8"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Release Notes"
            ],
            "url": "https://mybb.com/versions/1.8.37/"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T23:33:02+00:00",
      "cve": "CVE-2023-46251",
      "id": "CVE-2023-46251",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Visual editor persistent Cross-site Scripting (XSS) in MyBB",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-46251.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T20:37:40.233Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "name": "https://github.com/mybb/mybb/security/advisories/GHSA-wj33-q7vj-9fr8",
                "tags": [
                  "x_refsource_CONFIRM",
                  "x_transferred"
                ],
                "url": "https://github.com/mybb/mybb/security/advisories/GHSA-wj33-q7vj-9fr8"
              },
              {
                "name": "https://github.com/mybb/mybb/commit/6dcaf0b4db6254f1833fe8dae295d9ddc2219276",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://github.com/mybb/mybb/commit/6dcaf0b4db6254f1833fe8dae295d9ddc2219276"
              },
              {
                "name": "https://mybb.com/versions/1.8.37/",
                "tags": [
                  "x_refsource_MISC",
                  "x_transferred"
                ],
                "url": "https://mybb.com/versions/1.8.37/"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "mybb",
                "vendor": "mybb",
                "versions": [
                  {
                    "lessThan": "1.8.37",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-46251",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-04T19:26:53.568111Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-04T19:32:36.215Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "mybb",
              "vendor": "mybb",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.8.37"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": " MyBB is a free and open source forum software. Custom MyCode (BBCode) for the visual editor (_SCEditor_) doesn\u0027t escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as a post or Private Message) and operates on a maliciously crafted MyCode message. This may occur on pages where message content is pre-filled using a GET/POST parameter, or on reply pages where a previously saved malicious message is quoted. The impact is be mitigated when: 1. the visual editor is disabled globally (_Admin CP \u2192 Configuration \u2192 Settings \u2192 Clickable Smilies and BB Code: [Clickable MyCode Editor](https://github.com/mybb/mybb/blob/mybb_1836/install/resources/settings.xml#L2087-L2094)_ is set to _Off_), or 2. the visual editor is disabled for individual user accounts (_User CP \u2192 Your Profile \u2192 Edit Options_: _Show the MyCode formatting options on the posting pages_ checkbox is not checked). MyBB 1.8.37 resolves this issue with the commit `6dcaf0b4d`. Users are advised to upgrade. Users unable to upgrade may mitigate the impact without upgrading MyBB by changing the following setting (_Admin CP \u2192 Configuration \u2192 Settings_):\n- _Clickable Smilies and BB Code \u2192 [Clickable MyCode Editor](https://github.com/mybb/mybb/blob/mybb_1836/install/resources/settings.xml#L2087-L2094)_: _Off_. Similarly, individual MyBB forum users are able to disable the visual editor by diabling the account option (_User CP \u2192 Your Profile \u2192 Edit Options_) _Show the MyCode formatting options on the posting pages_."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-11-06T17:41:30.378Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/mybb/mybb/security/advisories/GHSA-wj33-q7vj-9fr8",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/mybb/mybb/security/advisories/GHSA-wj33-q7vj-9fr8"
            },
            {
              "name": "https://github.com/mybb/mybb/commit/6dcaf0b4db6254f1833fe8dae295d9ddc2219276",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/mybb/mybb/commit/6dcaf0b4db6254f1833fe8dae295d9ddc2219276"
            },
            {
              "name": "https://mybb.com/versions/1.8.37/",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://mybb.com/versions/1.8.37/"
            }
          ],
          "source": {
            "advisory": "GHSA-wj33-q7vj-9fr8",
            "discovery": "UNKNOWN"
          },
          "title": "Visual editor persistent Cross-site Scripting (XSS) in MyBB"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2023-46251",
        "datePublished": "2023-11-06T17:41:30.378Z",
        "dateReserved": "2023-10-19T20:34:00.948Z",
        "dateUpdated": "2024-09-04T19:32:41.984Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.