PT-2024-19816

CVE-2024-23335

Published

2024-05-01

Updated

2025-06-30

Description by

CVSS 3.1

4.7

Medium

MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.38

Description The backup management module of the Admin CP in MyBB may accept .htaccess as the name of the backup file to be deleted, potentially exposing stored backup files over HTTP on Apache servers.

Recommendations For MyBB versions prior to 1.8.38, upgrade to MyBB 1.8.38 to resolve the issue. As a temporary workaround, consider restricting access to the backup management module in the Admin CP until the upgrade is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Shin24

Vendors

Affected products

Weakness enumeration

CWE-20: Improper Input Validation

Related identifiers

CVE-2024-23335