PT-2019-18393

CVE-2019-6979

·

Published

2019-01-28

·

Updated

2019-01-29

Description by

CVSS 3.1
6.1
Medium
MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions MyBB User IP History Logs plugin version 1.0.2
Description An issue was discovered in the User IP History Logs plugin for MyBB, where there is a cross-site scripting (XSS) vulnerability via the useragent field in the admin/modules/tools/ip history logs.php API endpoint.
Recommendations For MyBB User IP History Logs plugin version 1.0.2, consider disabling the admin/modules/tools/ip history logs.php endpoint until a patch is available to prevent exploitation of the XSS vulnerability via the useragent field.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2019-6979
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com