{"api_version":"1","generated_at":"2026-07-23T06:37:23+00:00","cve":"CVE-2015-2334","urls":{"html":"https://cve.report/CVE-2015-2334","api":"https://cve.report/api/cve/CVE-2015-2334.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2015-2334","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-2334"},"summary":{"title":"CVE-2015-2334","description":"Cross-site request forgery (CSRF) vulnerability in the Admin Control Panel (ACP) login in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.","state":"PUBLISHED","assigner":"mitre","published_at":"2015-03-18 14:59:03","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-352","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.8","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release/","name":"http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"MyBB 1.8.4 Released – Feature Update, Security & Maintenance Release | MyBB Blog","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/73214","name":"http://www.securityfocus.com/bid/73214","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"MyBB CVE-2015-2334 Cross Site Request Forgery Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.securitytracker.com/id/1031953","name":"http://www.securitytracker.com/id/1031953","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"MyBB Bugs Permit Cross-Site Scripting, Cross-Site Request Forgery, and Information Disclosure Attacks - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-2334","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-2334","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2015","cve_id":"2334","vulnerable":"1","versionEndIncluding":"1.8.3","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mybb","cpe5":"mybb","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T05:10:16.265Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release/"},{"name":"73214","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/73214"},{"name":"1031953","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1031953"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2015-02-15T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site request forgery (CSRF) vulnerability in the Admin Control Panel (ACP) login in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2016-11-30T18:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release/"},{"name":"73214","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/73214"},{"name":"1031953","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1031953"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2015-2334","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site request forgery (CSRF) vulnerability in the Admin Control Panel (ACP) login in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release/","refsource":"CONFIRM","url":"http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release/"},{"name":"73214","refsource":"BID","url":"http://www.securityfocus.com/bid/73214"},{"name":"1031953","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1031953"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2015-2334","datePublished":"2015-03-18T14:00:00.000Z","dateReserved":"2015-03-18T00:00:00.000Z","dateUpdated":"2024-08-06T05:10:16.265Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-03-18 14:59:03","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-352","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*","versionEndIncluding":"1.8.3","matchCriteriaId":"AEC41207-93E4-416F-9670-6AC626CF0700"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2015","CveId":"2334","Ordinal":"1","Title":"CVE-2015-2334","CVE":"CVE-2015-2334","Year":"2015"},"notes":[{"CveYear":"2015","CveId":"2334","Ordinal":"1","NoteData":"Cross-site request forgery (CSRF) vulnerability in the Admin Control Panel (ACP) login in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.","Type":"Description","Title":"CVE-2015-2334"},{"CveYear":"2015","CveId":"2334","Ordinal":"2","NoteData":"2015-03-18","Type":"Other","Title":"Published"},{"CveYear":"2015","CveId":"2334","Ordinal":"3","NoteData":"2016-11-30","Type":"Other","Title":"Modified"}]}}}