CVE-2024-23336

MEDIUM
Published May 1, 2024 Modified Jun 30, 2025 CWE-184 CWE-918

Description

MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's _Disallowed Remote Addresses_ list (`$config['disallowed_remote_addresses']`) contains the address `127.0.0.1`, but does not include the complete block `127.0.0.0/8`. MyBB 1.8.38 resolves this issue in default installations. Administrators of installed boards should update the existing configuration (`inc/config.php`) to include all addresses blocked by default. Additionally, users are advised to verify that it includes any other IPv4 addresses resolving to the server and other internal resources. Users unable to upgrade may manually add 127.0.0.0/8' to their disallowed address list.

Is your site exposed to CVE-2024-23336?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.0
MEDIUM
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness Type (CWE)

CWE-184 CWE-184
CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Vendor Product
mybb mybb

References

Frequently Asked Questions

What is CVE-2024-23336? +
MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's _Disallowed Remote Addresses_ list (`$config['disallowed_remote_addresses']`) contains the address `127.0.0.1`, but does not include the complete block `127.0.0.0/8`. MyBB 1.8.38 resolves this issue in default installations. Administrators of installed boards should update the existing configuration (`inc/config.php`) to include all addresses blocked by default. Additionally, users are advised to verify that it includes any other IPv4 addresses resolving to the server and other internal resources. Users unable to upgrade may manually add 127.0.0.0/8' to their disallowed address list. It has a CVSS v3.1 base score of 5.0 (MEDIUM).
How severe is CVE-2024-23336? +
CVE-2024-23336 has a CVSS v3.1 score of 5.0 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.
What products are affected by CVE-2024-23336? +
CVE-2024-23336 affects products from mybb, specifically: mybb. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2024-23336? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-71355

Picklescan before 0.0.25 fails to detect unsafe global functions in the Numpy library, allowing attackers to bypass static analysis and …
CVE-2026-54090

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior …
CVE-2026-69263

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the …
CVE-2026-70470

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise …
CVE-2026-49869 10.0

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist …
CVE-2024-51745 10.0

Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2024-23336 — free, no signup required.