UpHeron
All vulnerabilities

Servers and applications

CVE-2024-23336

MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's _Disallowed Remote Addresses_ list (`$config['disallowed_remote_addresses']`) contains the address `127.0.0.1`, but does not include the complete block `127.0.0.0/8`.…

Severity
Medium 5.0
Published
1 May 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.8.38
Sources
NVD

Affected software

SoftwareAffected versions
MyBBServers and applications · cpe:a:mybb:mybb
  • Every version before 1.8.38

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-23336
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-23336