CVE-2008-7082 - Vulnerability Details - OpenCVE

MyBB (aka MyBulletinBoard) 1.4.3 includes the sensitive my_post_key parameter in URLs to moderation.php with the (1) mergeposts, (2) split, and (3) deleteposts actions, which allows remote attackers to steal the token and bypass the cross-site request forgery (CSRF) protection mechanism to hijack the authentication of moderators by reading the token from the HTTP Referer header.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00105.

Key SSVC decision points have not yet been added.

Vendors	Products
Mybb	Mybb

Configuration 1 [-]

cpe:2.3:a:mybb:mybb:1.4.3:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2008-7041	MyBB (aka MyBulletinBoard) 1.4.3 includes the sensitive my_post_key parameter in URLs to moderation.php with the (1) mergeposts, (2) split, and (3) deleteposts actions, which allows remote attackers to steal the token and bypass the cross-site request forgery (CSRF) protection mechanism to hijack the authentication of moderators by reading the token from the HTTP Referer header.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://osvdb.org/50275
http://secunia.com/advisories/32880
http://www.securityfocus.com/archive/1/498630/100/0/threaded
http://www.securityfocus.com/bid/32467
https://exchange.xforce.ibmcloud.com/vulnerabilities/46885

History

Fri, 26 Sep 2025 19:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mybb Mybb mybb
CPEs	cpe:2.3:a:mybboard:mybb:1.4.3:::::::*	cpe:2.3:a:mybb:mybb:1.4.3:::::::*
Vendors & Products	Mybboard Mybboard mybb	Mybb Mybb mybb

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2009-08-25T10:00:00

Updated: 2024-08-07T11:56:14.019Z

Reserved: 2009-08-24T00:00:00

Link: CVE-2008-7082

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2009-08-25T10:30:00.733

Modified: 2025-09-26T19:39:38.973

Link: CVE-2008-7082

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2008-11-25T00:00:00", "descriptions": [{"lang": "en", "value": "MyBB (aka MyBulletinBoard) 1.4.3 includes the sensitive my_post_key parameter in URLs to moderation.php with the (1) mergeposts, (2) split, and (3) deleteposts actions, which allows remote attackers to steal the token and bypass the cross-site request forgery (CSRF) protection mechanism to hijack the authentication of moderators by reading the token from the HTTP Referer header."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-11T19:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "20081125 MyBB 1.4.3 my_post_key Disclosure Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/498630/100/0/threaded"}, {"name": "32467", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/32467"}, {"name": "32880", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/32880"}, {"name": "mybb-mypostkey-weak-security(46885)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46885"}, {"name": "50275", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/50275"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2008-7082", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "MyBB (aka MyBulletinBoard) 1.4.3 includes the sensitive my_post_key parameter in URLs to moderation.php with the (1) mergeposts, (2) split, and (3) deleteposts actions, which allows remote attackers to steal the token and bypass the cross-site request forgery (CSRF) protection mechanism to hijack the authentication of moderators by reading the token from the HTTP Referer header."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20081125 MyBB 1.4.3 my_post_key Disclosure Vulnerability", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/498630/100/0/threaded"}, {"name": "32467", "refsource": "BID", "url": "http://www.securityfocus.com/bid/32467"}, {"name": "32880", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/32880"}, {"name": "mybb-mypostkey-weak-security(46885)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46885"}, {"name": "50275", "refsource": "OSVDB", "url": "http://osvdb.org/50275"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T11:56:14.019Z"}, "title": "CVE Program Container", "references": [{"name": "20081125 MyBB 1.4.3 my_post_key Disclosure Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/498630/100/0/threaded"}, {"name": "32467", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/32467"}, {"name": "32880", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/32880"}, {"name": "mybb-mypostkey-weak-security(46885)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46885"}, {"name": "50275", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/50275"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2008-7082", "datePublished": "2009-08-25T10:00:00", "dateReserved": "2009-08-24T00:00:00", "dateUpdated": "2024-08-07T11:56:14.019Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mybb:mybb:1.4.3:*:*:*:*:*:*:*", "matchCriteriaId": "0F6FC2B1-45DF-439E-8BAE-A15A08E7D9F7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MyBB (aka MyBulletinBoard) 1.4.3 includes the sensitive my_post_key parameter in URLs to moderation.php with the (1) mergeposts, (2) split, and (3) deleteposts actions, which allows remote attackers to steal the token and bypass the cross-site request forgery (CSRF) protection mechanism to hijack the authentication of moderators by reading the token from the HTTP Referer header."}, {"lang": "es", "value": "MyBB (tambi\u00e9n conocido como MyBulletinBoard) v1.4.3 incluye el par\u00e1metro \"my_post_key\" en URLs en moderation.php con las acciones (1) \"mergeposts\", (2) \"split\", y (3) \"deleteposts\", lo que permitir\u00eda a atacantes remotos robar la credencial de autenticaci\u00f3n y evitar la protecci\u00f3n de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) y secuestrar la autenticaci\u00f3n de los moderadores mediante la lectura de la credencial de autenticaci\u00f3n de la cabecera HTTP."}], "id": "CVE-2008-7082", "lastModified": "2025-09-26T19:39:38.973", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2009-08-25T10:30:00.733", "references": [{"source": "cve@mitre.org", "url": "http://osvdb.org/50275"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/32880"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/498630/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/32467"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46885"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/50275"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/32880"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/498630/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/32467"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46885"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}