CVE-2024-23336

MEDIUM
Published May 1, 2024 Modified Jun 30, 2025 CWE-184 CWE-918

Description

MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's _Disallowed Remote Addresses_ list (`$config['disallowed_remote_addresses']`) contains the address `127.0.0.1`, but does not include the complete block `127.0.0.0/8`. MyBB 1.8.38 resolves this issue in default installations. Administrators of installed boards should update the existing configuration (`inc/config.php`) to include all addresses blocked by default. Additionally, users are advised to verify that it includes any other IPv4 addresses resolving to the server and other internal resources. Users unable to upgrade may manually add 127.0.0.0/8' to their disallowed address list.

Is your site exposed to CVE-2024-23336?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.0
MEDIUM
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness Type (CWE)

CWE-184 CWE-184
CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Vendor Product
mybb mybb

References

Frequently Asked Questions

What is CVE-2024-23336? +
MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's _Disallowed Remote Addresses_ list (`$config['disallowed_remote_addresses']`) contains the address `127.0.0.1`, but does not include the complete block `127.0.0.0/8`. MyBB 1.8.38 resolves this issue in default installations. Administrators of installed boards should update the existing configuration (`inc/config.php`) to include all addresses blocked by default. Additionally, users are advised to verify that it includes any other IPv4 addresses resolving to the server and other internal resources. Users unable to upgrade may manually add 127.0.0.0/8' to their disallowed address list. It has a CVSS v3.1 base score of 5.0 (MEDIUM).
How severe is CVE-2024-23336? +
CVE-2024-23336 has a CVSS v3.1 score of 5.0 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.
What products are affected by CVE-2024-23336? +
CVE-2024-23336 affects products from mybb, specifically: mybb. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2024-23336? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-69263

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the …
CVE-2026-79696

A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 …
CVE-2026-61851

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create …
CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature …
CVE-2026-87985

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. …
CVE-2026-63206

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2024-23336 — free, no signup required.