{"api_version":"1","generated_at":"2026-07-23T09:38:37+00:00","cve":"CVE-2009-4449","urls":{"html":"https://cve.report/CVE-2009-4449","api":"https://cve.report/api/cve/CVE-2009-4449.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2009-4449","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2009-4449"},"summary":{"title":"CVE-2009-4449","description":"Directory traversal vulnerability in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, when changing the user avatar from the gallery, allows remote authenticated users to determine the existence of files via directory traversal sequences in the avatar and possibly the gallery parameters, related to (1) admin/modules/user/users.php and (2) usercp.php.","state":"PUBLISHED","assigner":"mitre","published_at":"2009-12-29 20:41:20","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-22","n/a"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.3","severity":"","vector":"AV:N/AC:M/Au:S/C:C/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:C/I:N/A:N","baseScore":6.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://blog.mybboard.net/2009/12/29/mybb-1-4-11-released-minor-patch-security-update/","name":"http://blog.mybboard.net/2009/12/29/mybb-1-4-11-released-minor-patch-security-update/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes"],"title":"MyBB Blog  » Blog Archive   » MyBB 1.4.11 Released – Minor Patch & Security Update","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2009/3651","name":"http://www.vupen.com/english/advisories/2009/3651","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Permissions Required","Vendor Advisory"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.4-stable/usercp.php","name":"http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.4-stable/usercp.php","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Exploit"],"title":"","mime":"","httpstatus":"-1","archivestatus":"404"},{"url":"http://openwall.com/lists/oss-security/2010/12/06/2","name":"http://openwall.com/lists/oss-security/2010/12/06/2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"title":"oss-security - Re: CVE request: mybb before 1.4.11 and before 1.4.12","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/37906","name":"http://secunia.com/advisories/37906","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Vendor Advisory"],"title":"MyBB Avatar Change File Enumeration Security Issue - Secunia Advisories - Vulnerability Information - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/37489","name":"http://www.securityfocus.com/bid/37489","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Third Party Advisory","VDB Entry"],"title":"MyBB 'Avatar' Parameter File Enumeration Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://openwall.com/lists/oss-security/2010/10/11/8","name":"http://openwall.com/lists/oss-security/2010/10/11/8","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"title":"oss-security - Re: CVE request: mybb before 1.4.11 and before\n 1.4.12","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.4-stable/admin/modules/user/users.php","name":"http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.4-stable/admin/modules/user/users.php","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Exploit"],"title":"","mime":"","httpstatus":"-1","archivestatus":"404"},{"url":"http://osvdb.org/61359","name":"http://osvdb.org/61359","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://dev.mybboard.net/issues/617","name":"http://dev.mybboard.net/issues/617","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"MyBB - Bug #617: Avatar gallery url sanitation - MyBulletinBoard Development Site","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://openwall.com/lists/oss-security/2010/10/08/7","name":"http://openwall.com/lists/oss-security/2010/10/08/7","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"title":"oss-security - CVE request: mybb before 1.4.11 and before 1.4.12","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-4449","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-4449","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2009","cve_id":"4449","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mybb","cpe5":"mybb","cpe6":"1.4.10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T07:01:20.338Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"37489","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/37489"},{"name":"[oss-security] 20101008 CVE request: mybb before 1.4.11 and before 1.4.12","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://openwall.com/lists/oss-security/2010/10/08/7"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.4-stable/admin/modules/user/users.php"},{"name":"37906","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/37906"},{"name":"[oss-security] 20101011 Re: CVE request: mybb before 1.4.11 and before 1.4.12","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://openwall.com/lists/oss-security/2010/10/11/8"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://dev.mybboard.net/issues/617"},{"name":"ADV-2009-3651","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2009/3651"},{"name":"[oss-security] 20101206 Re: CVE request: mybb before 1.4.11 and before 1.4.12","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://openwall.com/lists/oss-security/2010/12/06/2"},{"name":"61359","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/61359"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://blog.mybboard.net/2009/12/29/mybb-1-4-11-released-minor-patch-security-update/"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.4-stable/usercp.php"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2009-12-28T00:00:00.000Z","descriptions":[{"lang":"en","value":"Directory traversal vulnerability in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, when changing the user avatar from the gallery, allows remote authenticated users to determine the existence of files via directory traversal sequences in the avatar and possibly the gallery parameters, related to (1) admin/modules/user/users.php and (2) usercp.php."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2011-01-04T10:00:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"37489","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/37489"},{"name":"[oss-security] 20101008 CVE request: mybb before 1.4.11 and before 1.4.12","tags":["mailing-list","x_refsource_MLIST"],"url":"http://openwall.com/lists/oss-security/2010/10/08/7"},{"tags":["x_refsource_CONFIRM"],"url":"http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.4-stable/admin/modules/user/users.php"},{"name":"37906","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/37906"},{"name":"[oss-security] 20101011 Re: CVE request: mybb before 1.4.11 and before 1.4.12","tags":["mailing-list","x_refsource_MLIST"],"url":"http://openwall.com/lists/oss-security/2010/10/11/8"},{"tags":["x_refsource_CONFIRM"],"url":"http://dev.mybboard.net/issues/617"},{"name":"ADV-2009-3651","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2009/3651"},{"name":"[oss-security] 20101206 Re: CVE request: mybb before 1.4.11 and before 1.4.12","tags":["mailing-list","x_refsource_MLIST"],"url":"http://openwall.com/lists/oss-security/2010/12/06/2"},{"name":"61359","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/61359"},{"tags":["x_refsource_CONFIRM"],"url":"http://blog.mybboard.net/2009/12/29/mybb-1-4-11-released-minor-patch-security-update/"},{"tags":["x_refsource_CONFIRM"],"url":"http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.4-stable/usercp.php"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2009-4449","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Directory traversal vulnerability in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, when changing the user avatar from the gallery, allows remote authenticated users to determine the existence of files via directory traversal sequences in the avatar and possibly the gallery parameters, related to (1) admin/modules/user/users.php and (2) usercp.php."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"37489","refsource":"BID","url":"http://www.securityfocus.com/bid/37489"},{"name":"[oss-security] 20101008 CVE request: mybb before 1.4.11 and before 1.4.12","refsource":"MLIST","url":"http://openwall.com/lists/oss-security/2010/10/08/7"},{"name":"http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.4-stable/admin/modules/user/users.php","refsource":"CONFIRM","url":"http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.4-stable/admin/modules/user/users.php"},{"name":"37906","refsource":"SECUNIA","url":"http://secunia.com/advisories/37906"},{"name":"[oss-security] 20101011 Re: CVE request: mybb before 1.4.11 and before 1.4.12","refsource":"MLIST","url":"http://openwall.com/lists/oss-security/2010/10/11/8"},{"name":"http://dev.mybboard.net/issues/617","refsource":"CONFIRM","url":"http://dev.mybboard.net/issues/617"},{"name":"ADV-2009-3651","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2009/3651"},{"name":"[oss-security] 20101206 Re: CVE request: mybb before 1.4.11 and before 1.4.12","refsource":"MLIST","url":"http://openwall.com/lists/oss-security/2010/12/06/2"},{"name":"61359","refsource":"OSVDB","url":"http://osvdb.org/61359"},{"name":"http://blog.mybboard.net/2009/12/29/mybb-1-4-11-released-minor-patch-security-update/","refsource":"CONFIRM","url":"http://blog.mybboard.net/2009/12/29/mybb-1-4-11-released-minor-patch-security-update/"},{"name":"http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.4-stable/usercp.php","refsource":"CONFIRM","url":"http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.4-stable/usercp.php"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2009-4449","datePublished":"2009-12-29T20:15:00.000Z","dateReserved":"2009-12-29T00:00:00.000Z","dateUpdated":"2024-08-07T07:01:20.338Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2009-12-29 20:41:20","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-22","n/a"],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:C/I:N/A:N","baseScore":6.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":6.8,"impactScore":6.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mybb:mybb:1.4.10:*:*:*:*:*:*:*","matchCriteriaId":"1FF9452B-CF4B-45F0-8487-23D9CCBB1A4A"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2009","CveId":"4449","Ordinal":"1","Title":"CVE-2009-4449","CVE":"CVE-2009-4449","Year":"2009"},"notes":[{"CveYear":"2009","CveId":"4449","Ordinal":"1","NoteData":"Directory traversal vulnerability in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, when changing the user avatar from the gallery, allows remote authenticated users to determine the existence of files via directory traversal sequences in the avatar and possibly the gallery parameters, related to (1) admin/modules/user/users.php and (2) usercp.php.","Type":"Description","Title":"CVE-2009-4449"},{"CveYear":"2009","CveId":"4449","Ordinal":"2","NoteData":"2009-12-29","Type":"Other","Title":"Published"},{"CveYear":"2009","CveId":"4449","Ordinal":"3","NoteData":"2011-01-04","Type":"Other","Title":"Modified"}]}}}