nvd-json-data-feeds/CVE-2015/CVE-2015-89xx/CVE-2015-8973.json

{
  "id": "CVE-2015-8973",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2017-01-31T22:59:00.140",
  "lastModified": "2017-02-05T21:11:46.677",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password."
    },
    {
      "lang": "es",
      "value": "xmlhttp.php en MyBB (tambi\u00e9n conocido como MyBulletinBoard) en versiones anteriores a 1.6.18 y 1.8.x en versiones anteriores a 1.8.6 y MyBB Merge System en versiones anteriores a 1.8.6 permite a atacantes remotos eludir las restricciones de acceso previstas a trav\u00e9s de vectores relacionados con la contrase\u00f1a del foro."
    }
  ],
  "metrics": {
    "cvssMetricV30": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.0",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW",
          "baseScore": 8.3,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.7
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5
        },
        "baseSeverity": "HIGH",
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "acInsufInfo": true,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:mybb:merge_system:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "1.8.5",
              "matchCriteriaId": "22907EC0-5A2D-4DCF-B887-8FA311B3D4E2"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
              "versionEndIncluding": "1.6.17",
              "matchCriteriaId": "2FF6F484-A280-45A6-BB5E-B923339B7109"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:mybb:mybb:1.8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E697D13C-5594-491B-B911-3B4BEA00AFCC"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:mybb:mybb:1.8.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "00724054-858F-4322-8BE5-F6929CC2CAD8"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:mybb:mybb:1.8.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "95998F68-1F16-4FEA-BDE3-957235D04881"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:mybb:mybb:1.8.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "927F9547-773B-4F2C-8870-AA3672EEC7CA"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:mybb:mybb:1.8.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "6817FA9E-51B7-4ADE-86E2-E9F559A585EC"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:mybb:mybb:1.8.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "667EFFF1-E5C1-4124-BD0B-D4244FAECE15"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    },
    {
      "url": "http://www.securityfocus.com/bid/94397",
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ]
    },
    {
      "url": "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
      "source": "cve@mitre.org",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ]
    }
  ]
}