PT-2012-2223 · Vbulletin Solutions · Vbulletin

Publicado 2012-12-31 · Atualizado 2013-01-03 · CVE-2011-5251

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions vBulletin versions 4.1.3 and earlier

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via the url parameter in a "lostpw" action in the "forum/login.php" endpoint.

Recommendations For versions 4.1.3 and earlier, consider restricting access to the "lostpw" action in the "forum/login.php" endpoint until a fix is available. As a temporary workaround, avoid using the url parameter in the affected endpoint to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2011-5251

Produtos afetados

Vbulletin

Referências · 3

• http://vbulletin.com/forum/showthread.php/381014-Potential-Phishing-Vector?p=2166441 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-5251 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5251 · Nota