Medium severity · published Apr 27, 2023
CVE-2022-25091
Infopop Ultimate Bulletin Board up to v5.47a was discovered to allow all messages posted inside private forums to be disclosed by unauthenticated users via the quote reply feature
5.3
CVSS
0.6%
EPSS
No
On KEV
Description
Infopop Ultimate Bulletin Board up to v5.47a was discovered to allow all messages posted inside private forums to be disclosed by unauthenticated users via the quote reply feature.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UB
Ultimate Bulletin Board · Infopop
through 5.47a · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-25091
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-25091
Broken Link
http://www.infopop.com/support/ubbclassic/version5.html
Mailing List
https://marc.info/?l=vuln-dev&m=97486849231786&w=2
Mailing List
https://vulners.com/securityvulns/SECURITYVULNS:DOC:954
Not Applicable
https://web.archive.org/web/20030207100935/
Release Notes
https://web.archive.org/web/20030207100935/http://www.infopop.com/support/ubbclassic/version5.html
More from Ultimate Bulletin Board
–
CVE-2005-1199
SQL injection vulnerability in printthread.php in UBB.Threads allows remote attackers to execute arbitrary SQL commands via the main parameter
–
CVE-2003-0587
Cross-site scripting (XSS) vulnerability in Infopop Ultimate Bulletin Board (UBB) 6.x allows remote authenticated users to execute arbitrary web script and gain administrative…
–
CVE-2002-0223
Infopop UBB.Threads 5.4 and Wired Community Software WWWThreads 5.0 through 5.0.9 allows remote attackers to upload arbitrary files by using a filename that contains an accepted…
–
CVE-2002-0118
Cross-site scripting vulnerability in Infopop Ultimate Bulletin Board (UBB) 6.2.0 Beta Release 1.0 allows remote attackers to execute arbitrary script and steal cookies via a…
–
CVE-2001-0897
Cross-site scripting vulnerability in Infopop Ultimate Bulletin Board (UBB) before 5.47e allows remote attackers to steal user cookies via an [IMG] tag that references an about:…