CVE-2021-47934mediumCWE-79

CVE-2021-47934: medium-severity vulnerability in MyBB Timeline Plugin

MyBB Timeline Plugin 1.0 Cross-Site Scripting and CSRF

Published · Updated

Follow this CVE+ Monitor MyBB Timeline Plugin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.9epss 0.2%
In short

MyBB Timeline Plugin 1.0 allows attackers to inject harmful scripts into thread titles, posts, and user profiles, which run when others view the content. Attackers can also trick users into changing their cover pictures without permission.

Technical detail

The plugin fails to properly sanitize user inputs in thread titles, post content, and profile fields (Location, Bio), enabling stored XSS attacks. Additionally, the timeline.php profile action lacks CSRF token validation, allowing attackers to forge requests that modify a user's cover picture when the victim visits a malicious page.

Summary generated and translated by AI from the official description.
MyBB Timeline Plugin 1.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through thread titles, post content, and user profile fields like Location and Bio. Attackers can also exploit a cross-site request forgery vulnerability in the timeline.php profile action to change a user's cover picture by crafting malicious forms that execute when victims visit affected profiles.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
Affected products
MyBB · MyBB Timeline Plugin
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.