CVE-2022-24734

{"id": "CVE-2022-24734", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2022-03-09T22:15:09.363", "references": [{"url": "http://packetstormsecurity.com/files/167082/MyBB-1.8.29-Remote-Code-Execution.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "security-advisories@github.com"}, {"url": "http://packetstormsecurity.com/files/167333/MyBB-Admin-Control-Remote-Code-Execution.html", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mybb/mybb/commit/92012b9831b330714b9f9b4646a98784113489c1", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mybb/mybb/security/advisories/GHSA-876v-gwgh-w57f", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://mybb.com/versions/1.8.30/", "tags": ["Release Notes", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-503/", "tags": ["Third Party Advisory", "VDB Entry", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type `php` with PHP code, executed on on _Change Settings_ pages. This results in a Remote Code Execution (RCE) vulnerability. The vulnerable module requires Admin CP access with the `Can manage settings?` permission. MyBB's Settings module, which allows administrators to add, edit, and delete non-default settings, stores setting data in an options code string ($options_code; mybb_settings.optionscode database column) that identifies the setting type and its options, separated by a new line character (\\n). In MyBB 1.2.0, support for setting type php was added, for which the remaining part of the options code is PHP code executed on Change Settings pages (reserved for plugins and internal use). MyBB 1.8.30 resolves this issue. There are no known workarounds."}, {"lang": "es", "value": "MyBB es un software de foros gratuito y de c\u00f3digo abierto. En las versiones afectadas, el m\u00f3dulo de gesti\u00f3n de configuraciones del CP de administraci\u00f3n no valida correctamente los tipos de configuraciones en la inserci\u00f3n y actualizaci\u00f3n, lo que hace posible a\u00f1adir configuraciones de tipo soportado `php` con c\u00f3digo PHP, ejecutado en las p\u00e1ginas de _Cambio de Configuraciones_. Esto resulta en una vulnerabilidad de Ejecuci\u00f3n Remota de C\u00f3digo (RCE). El m\u00f3dulo vulnerable requiere el acceso al CP de administrador con el permiso `Can manage settings?`. El m\u00f3dulo de configuraci\u00f3n de MyBB, que permite a los administradores a\u00f1adir, editar y eliminar configuraciones no predeterminadas, almacena los datos de configuraci\u00f3n en una cadena de c\u00f3digo de opciones ($options_code; columna de la base de datos mybb_settings.optionscode) que identifica el tipo de configuraci\u00f3n y sus opciones, separadas por un car\u00e1cter de nueva l\u00ednea (\\n). En MyBB 1.2.0, se a\u00f1adi\u00f3 soporte para el tipo de configuraci\u00f3n php, para el cual la parte restante del c\u00f3digo de opciones es c\u00f3digo PHP ejecutado en las p\u00e1ginas de cambio de configuraci\u00f3n (reservado para plugins y uso interno). MyBB 1.8.30 resuelve este problema. No se presentan medidas de mitigaci\u00f3n conocidas"}], "lastModified": "2022-09-30T13:22:56.523", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "362CD6E4-2CC7-42AF-AAAA-5C3A6D47929E", "versionEndExcluding": "1.8.30", "versionStartIncluding": "1.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}