PT-2017-6669 · Vbulletin Solutions · Vbulletin

Patrick William · Publicado 2017-09-19 · Atualizado 2017-09-26 · CVE-2015-3419

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions vBulletin versions 5.x through 5.1.6

Description The issue allows remote authenticated users to bypass authorization checks and inject private messages into conversations. This is due to an input validation failure.

Recommendations For versions 5.x through 5.1.6, update to a version that contains a fix for this issue to prevent unauthorized access and private message injection.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2015-3419

Produtos afetados

Vbulletin

Referências · 4

• http://openwall.com/lists/oss-security/2015/04/24/4 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3419 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-3419 · Nota de Segurança
• http://vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4319488-security-patch-released-for-vbulletin-5-1-4-5-1-6-and-vbulletin-cloud · Aviso do Fabricante