CVE-2008-0788

{"id": "CVE-2008-0788", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2008-02-15T01:00:00.000", "references": [{"url": "http://community.mybboard.net/showthread.php?tid=27675", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/28572/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/3656", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/486663", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2008/0238", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site request forgery (CSRF) vulnerabilities in MyBB 1.2.11 and earlier allow remote attackers to (1) hijack the authentication of moderators or administrators for requests that delete threads via a do_multideletethreads action to moderation.php and (2) hijack the authentication of arbitrary users for requests that delete private messages (PM) via a delete action to private.php."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de tipo cross-site request forgery (CSRF) en MyBB versi\u00f3n 1.2.11 y anteriores, permiten a los atacantes remotos (1) secuestrar la autenticaci\u00f3n de moderadores o administradores para las peticiones que eliminan hilos (subprocesos) por medio de una acci\u00f3n do_multideletethreads para el archivo moderation.php y (2) secuestran la autenticaci\u00f3n de usuarios arbitrarios para peticiones que eliminan mensajes privados (PM) por medio de una acci\u00f3n delete en private.php."}], "lastModified": "2009-08-20T04:00:00.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "584748F9-2F9A-4FC8-8C4B-0C30E54F6FED", "versionEndIncluding": "1.2.11"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}