CVE-2024-23335CWE-20

Backups directory .htaccess deletion in. MyBB

Medium · published May 1, 2024

CVSS v3.1

4.7

EPSS

Percentile

45.8

In the wild

Unconfirmed

What it is

MyBB is a free and open source forum software. The backup management module of the Admin CP may accept `.htaccess` as the name of the backup file to be deleted, which may expose the stored backup files over HTTP on Apache servers. MyBB 1.8.38 resolves this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability

The record

Technical detail

CVSS v3.1: 4.7 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.00559 · 45.8th percentile
Weakness: CWE-20 · Improper Input Validation
Published: 2024-05-01T06:27Z

EPSS history

Timeline

01 MAY 06:27Z
Backups directory .htaccess deletion in. MyBB
cvelistv5