BIT-mybb-2022-39265

    Dashboard / Vulnerabilities / BIT-mybb-2022-39265

    BIT-mybb-2022-39265

    Published: 6 Mar 2024Last Modified: 14 Oct 2025

    Summary:

    Details: MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information and Remote Code Execution (RCE). The vulnerable module requires Admin CP access with the `_Can manage settings?_` permission and may depend on configured file permissions. MyBB 1.8.31 resolves this issue with the commit `0cd318136a`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    References: https://github.com/mybb/mybb/blob/mybb_1830/install/resources/settings.xml#L2331-L2338, https://github.com/mybb/mybb/commit/0cd318136a10b029bb5c8a8f6dddf39d87519797, https://github.com/mybb/mybb/security/advisories/GHSA-hxhm-rq9f-7xj7, https://mybb.com/versions/1.8.31/

    Affected packages

    Package

    Name: mybb

    Purl: pkg:bitnami/mybb

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -1.8.31

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    BIT-mybb-2022-39265 | CVE-DB