CVE-2017-7566

MyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism.

• CWE-918

• http://www.securityfocus.com/bid/97480Third Party Advisory, VDB Entry
• https://blog.mybb.com/2017/04/04/mybb-1-8-11-merge-system-1-8-11-release/Patch, Vendor Advisory
• https://github.com/mybb/mybb/commit/f5de8fc2aad11e0d2583f585535ccfa2b46325db#diff-7fe6e55397c77ab9a0f5d57bc4cbe5b9R6781Patch
• https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170407-0_MyBB_SSRF_vulnerability_v10.txtExploit, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/97480Third Party Advisory, VDB Entry
• https://blog.mybb.com/2017/04/04/mybb-1-8-11-merge-system-1-8-11-release/Patch, Vendor Advisory
• https://github.com/mybb/mybb/commit/f5de8fc2aad11e0d2583f585535ccfa2b46325db#diff-7fe6e55397c77ab9a0f5d57bc4cbe5b9R6781Patch
• https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170407-0_MyBB_SSRF_vulnerability_v10.txtExploit, Patch, Third Party Advisory

Published

Apr 6, 2017

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-7560It was found that rhnsd PID files are created as world-writa…
• CVE-2017-7561Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 i…
• CVE-2017-7562An authentication bypass flaw was found in the way krb5's ce…6.5
• CVE-2017-7563In ARM Trusted Firmware 1.3, RO memory is always executable …8.1
• CVE-2017-7564In ARM Trusted Firmware through 1.3, the secure self-hosted …7.5
• CVE-2017-7565Splunk Hadoop Connect App has a path traversal vulnerability…
• CVE-2017-7568NetApp OnCommand Unified Manager for 7-Mode (core package) v…
• CVE-2017-7569In vBulletin before 5.3.0, remote attackers can bypass the C…
• CVE-2017-7570PivotX 2.3.11 allows remote authenticated Advanced users to …
• CVE-2017-7571public/rolechangeadmin in Faveo 1.9.3 allows CSRF. The impac…8
• CVE-2017-7572The _checkPolkitPrivilege function in serviceHelper.py in Ba…
• CVE-2017-7574Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Ele…9.8