CVE-2022-25091

Infopop Ultimate Bulletin Board up to v5.47a was discovered to allow all messages posted inside private forums to be disclosed by unauthenticated users via the quote reply feature.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
http://www.infopop.com/support/ubbclassic/version5.html	Broken Link
https://marc.info/?l=vuln-dev&m=97486849231786&w=2	Mailing List
https://vulners.com/securityvulns/SECURITYVULNS:DOC:954	Mailing List
https://web.archive.org/web/20030207100935/	Not Applicable
https://web.archive.org/web/20030207100935/http://www.infopop.com/support/ubbclassic/version5.html	Release Notes
http://www.infopop.com/support/ubbclassic/version5.html	Broken Link
https://marc.info/?l=vuln-dev&m=97486849231786&w=2	Mailing List
https://vulners.com/securityvulns/SECURITYVULNS:DOC:954	Mailing List
https://web.archive.org/web/20030207100935/	Not Applicable
https://web.archive.org/web/20030207100935/http://www.infopop.com/support/ubbclassic/version5.html	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:infopop:ultimate_bulletin_board:*:*:*:*:*:*:*:*

History

03 Feb 2025, 18:15

Type	Values Removed	Values Added
CWE		CWE-863

Information

Published : 2023-04-27 21:15

Updated : 2025-02-03 18:15

NVD link : CVE-2022-25091

Mitre link : CVE-2022-25091

CVE.ORG link : CVE-2022-25091

JSON object : View

Products Affected

infopop

ultimate_bulletin_board

CWE

NVD-CWE-noinfo CWE-863

Incorrect Authorization

{"id": "CVE-2022-25091", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2023-04-27T21:15:10.343", "references": [{"url": "http://www.infopop.com/support/ubbclassic/version5.html", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "https://marc.info/?l=vuln-dev&m=97486849231786&w=2", "tags": ["Mailing List"], "source": "cve@mitre.org"}, {"url": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:954", "tags": ["Mailing List"], "source": "cve@mitre.org"}, {"url": "https://web.archive.org/web/20030207100935/", "tags": ["Not Applicable"], "source": "cve@mitre.org"}, {"url": "https://web.archive.org/web/20030207100935/http://www.infopop.com/support/ubbclassic/version5.html", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "http://www.infopop.com/support/ubbclassic/version5.html", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://marc.info/?l=vuln-dev&m=97486849231786&w=2", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:954", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://web.archive.org/web/20030207100935/", "tags": ["Not Applicable"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://web.archive.org/web/20030207100935/http://www.infopop.com/support/ubbclassic/version5.html", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Infopop Ultimate Bulletin Board up to v5.47a was discovered to allow all messages posted inside private forums to be disclosed by unauthenticated users via the quote reply feature."}], "lastModified": "2025-02-03T18:15:27.707", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:infopop:ultimate_bulletin_board:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D03092C2-9DE5-4093-A5B0-7D84D703C355", "versionEndIncluding": "5.47a"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}