CVE-2008-7082

MyBB (aka MyBulletinBoard) 1.4.3 includes the sensitive my_post_key parameter in URLs to moderation.php with the (1) mergeposts, (2) split, and (3) deleteposts actions, which allows remote attackers to steal the token and bypass the cross-site request forgery (CSRF) protection mechanism to hijack the authentication of moderators by reading the token from the HTTP Referer header.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 29%
VendorProductVersion
mybboardmybb
1.4.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://osvdb.org/50275
http://secunia.com/advisories/32880
http://www.securityfocus.com/archive/1/498630/100/0/threaded
http://www.securityfocus.com/bid/32467
https://exchange.xforce.ibmcloud.com/vulnerabilities/46885
http://osvdb.org/50275
http://secunia.com/advisories/32880
http://www.securityfocus.com/archive/1/498630/100/0/threaded
http://www.securityfocus.com/bid/32467
https://exchange.xforce.ibmcloud.com/vulnerabilities/46885