CVE-2009-4448 - Vulnerability Details - OpenCVE

inc/functions_time.php in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, allows remote attackers to cause a denial of service (CPU consumption) via a crafted request with a large year value, which triggers a long loop, as reachable through member.php and possibly other vectors.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.01238.

Key SSVC decision points have not yet been added.

Vendors	Products
Mybb	Mybb

Configuration 1 [-]

cpe:2.3:a:mybb:mybb:1.4.10:*:*:*:*:*:*:*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://blog.mybboard.net/2009/12/29/mybb-1-4-11-released-minor-patch-security-update/
http://dev.mybboard.net/issues/600
http://dev.mybboard.net/projects/mybb/repository/revisions/4613/diff/branches/1.4-stable/inc/functions_time.php
http://openwall.com/lists/oss-security/2010/10/08/7
http://openwall.com/lists/oss-security/2010/10/11/8
http://openwall.com/lists/oss-security/2010/12/06/2
http://secunia.com/advisories/37906

History

Fri, 26 Sep 2025 19:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mybb Mybb mybb
CPEs	cpe:2.3:a:mybboard:mybb:1.4.10:::::::*	cpe:2.3:a:mybb:mybb:1.4.10:::::::*
Vendors & Products	Mybboard Mybboard mybb	Mybb Mybb mybb

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2009-12-29T20:15:00

Updated: 2024-08-07T07:01:20.701Z

Reserved: 2009-12-29T00:00:00

Link: CVE-2009-4448

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2009-12-29T20:41:20.453

Modified: 2025-09-26T19:39:38.973

Link: CVE-2009-4448

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2009-12-28T00:00:00", "descriptions": [{"lang": "en", "value": "inc/functions_time.php in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, allows remote attackers to cause a denial of service (CPU consumption) via a crafted request with a large year value, which triggers a long loop, as reachable through member.php and possibly other vectors."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2011-01-04T10:00:00", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "[oss-security] 20101008 CVE request: mybb before 1.4.11 and before 1.4.12", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://openwall.com/lists/oss-security/2010/10/08/7"}, {"name": "37906", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/37906"}, {"name": "[oss-security] 20101011 Re: CVE request: mybb before 1.4.11 and before 1.4.12", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://openwall.com/lists/oss-security/2010/10/11/8"}, {"name": "[oss-security] 20101206 Re: CVE request: mybb before 1.4.11 and before 1.4.12", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://openwall.com/lists/oss-security/2010/12/06/2"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://dev.mybboard.net/projects/mybb/repository/revisions/4613/diff/branches/1.4-stable/inc/functions_time.php"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://dev.mybboard.net/issues/600"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://blog.mybboard.net/2009/12/29/mybb-1-4-11-released-minor-patch-security-update/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2009-4448", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "inc/functions_time.php in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, allows remote attackers to cause a denial of service (CPU consumption) via a crafted request with a large year value, which triggers a long loop, as reachable through member.php and possibly other vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "[oss-security] 20101008 CVE request: mybb before 1.4.11 and before 1.4.12", "refsource": "MLIST", "url": "http://openwall.com/lists/oss-security/2010/10/08/7"}, {"name": "37906", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/37906"}, {"name": "[oss-security] 20101011 Re: CVE request: mybb before 1.4.11 and before 1.4.12", "refsource": "MLIST", "url": "http://openwall.com/lists/oss-security/2010/10/11/8"}, {"name": "[oss-security] 20101206 Re: CVE request: mybb before 1.4.11 and before 1.4.12", "refsource": "MLIST", "url": "http://openwall.com/lists/oss-security/2010/12/06/2"}, {"name": "http://dev.mybboard.net/projects/mybb/repository/revisions/4613/diff/branches/1.4-stable/inc/functions_time.php", "refsource": "CONFIRM", "url": "http://dev.mybboard.net/projects/mybb/repository/revisions/4613/diff/branches/1.4-stable/inc/functions_time.php"}, {"name": "http://dev.mybboard.net/issues/600", "refsource": "CONFIRM", "url": "http://dev.mybboard.net/issues/600"}, {"name": "http://blog.mybboard.net/2009/12/29/mybb-1-4-11-released-minor-patch-security-update/", "refsource": "CONFIRM", "url": "http://blog.mybboard.net/2009/12/29/mybb-1-4-11-released-minor-patch-security-update/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T07:01:20.701Z"}, "title": "CVE Program Container", "references": [{"name": "[oss-security] 20101008 CVE request: mybb before 1.4.11 and before 1.4.12", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://openwall.com/lists/oss-security/2010/10/08/7"}, {"name": "37906", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/37906"}, {"name": "[oss-security] 20101011 Re: CVE request: mybb before 1.4.11 and before 1.4.12", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://openwall.com/lists/oss-security/2010/10/11/8"}, {"name": "[oss-security] 20101206 Re: CVE request: mybb before 1.4.11 and before 1.4.12", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://openwall.com/lists/oss-security/2010/12/06/2"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://dev.mybboard.net/projects/mybb/repository/revisions/4613/diff/branches/1.4-stable/inc/functions_time.php"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://dev.mybboard.net/issues/600"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://blog.mybboard.net/2009/12/29/mybb-1-4-11-released-minor-patch-security-update/"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2009-4448", "datePublished": "2009-12-29T20:15:00", "dateReserved": "2009-12-29T00:00:00", "dateUpdated": "2024-08-07T07:01:20.701Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mybb:mybb:1.4.10:*:*:*:*:*:*:*", "matchCriteriaId": "1FF9452B-CF4B-45F0-8487-23D9CCBB1A4A", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "inc/functions_time.php in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, allows remote attackers to cause a denial of service (CPU consumption) via a crafted request with a large year value, which triggers a long loop, as reachable through member.php and possibly other vectors."}, {"lang": "es", "value": "inc/functions_time.php en MyBB (alias MyBulletinBoard) v1.4.10, y posiblemente versiones anteriores, permite a atacantes remotos provocar una denegaci\u00f3n de servicio (consumo de CPU) mediante una solicitud elaborada con un gran valor para el a\u00f1o, lo que dispara un bucle largo, como puede conseguirse a trav\u00e9s de member.php y posiblemente otros vectores."}], "id": "CVE-2009-4448", "lastModified": "2025-09-26T19:39:38.973", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2009-12-29T20:41:20.453", "references": [{"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://blog.mybboard.net/2009/12/29/mybb-1-4-11-released-minor-patch-security-update/"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://dev.mybboard.net/issues/600"}, {"source": "cve@mitre.org", "url": "http://dev.mybboard.net/projects/mybb/repository/revisions/4613/diff/branches/1.4-stable/inc/functions_time.php"}, {"source": "cve@mitre.org", "url": "http://openwall.com/lists/oss-security/2010/10/08/7"}, {"source": "cve@mitre.org", "url": "http://openwall.com/lists/oss-security/2010/10/11/8"}, {"source": "cve@mitre.org", "url": "http://openwall.com/lists/oss-security/2010/12/06/2"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/37906"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://blog.mybboard.net/2009/12/29/mybb-1-4-11-released-minor-patch-security-update/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://dev.mybboard.net/issues/600"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://dev.mybboard.net/projects/mybb/repository/revisions/4613/diff/branches/1.4-stable/inc/functions_time.php"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://openwall.com/lists/oss-security/2010/10/08/7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://openwall.com/lists/oss-security/2010/10/11/8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://openwall.com/lists/oss-security/2010/12/06/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/37906"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-399"}], "source": "nvd@nist.gov", "type": "Primary"}]}