PT-2008-4184 · Vbulletin Solutions · Vbulletin

Jessica Hope · Publicado 2008-06-17 · Atualizado 2018-10-11 · CVE-2008-2744

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions vBulletin versions 3.6.10 through 3.7.1

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via unknown vectors, possibly through an obscure method related to the redirect parameter in the Admin Control Panel, specifically the "admincp/index.php" endpoint.

Recommendations For versions 3.6.10 and 3.7.1, consider restricting access to the Admin Control Panel to minimize the risk of exploitation until a fix is available. Avoid using the redirect parameter in the "admincp/index.php" endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-2744

Produtos afetados

Vbulletin

Referências · 10

• 🔥 http://securityfocus.com/bid/29704 · Exploit
• 🔥 https://exploit-db.com/exploits/31910 · Exploit
• http://securityreason.com/securityalert/3946 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43090 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2744 · Nota
• http://securitytracker.com/id?1020322 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2744 · Nota de Segurança
• http://secunia.com/advisories/30733 · Aviso do Fabricante
• http://securityfocus.com/archive/1/493340/100/0/threaded · Nota
• http://vbulletin.com/forum/showthread.php?t=274882 · Nota