PT-2006-5082 · Jelsoft · Vbulletin

X-Boy · Published 2006-08-21 · Updated 2024-08-07 · CVE-2006-4272

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jelsoft vBulletin version 3.5.4

Description The issue allows remote attackers to register multiple arbitrary users, potentially causing a denial of service due to resource consumption. This can be achieved by sending a large number of requests to the "register.php" endpoint. It is worth noting that the vendor has disputed this issue, suggesting that enabling CAPTCHA would prevent registrations and that handling flood requests should be done at the server level.

Recommendations For Jelsoft vBulletin version 3.5.4, consider enabling CAPTCHA to prevent arbitrary user registrations. Additionally, configure server-level settings to handle and limit the number of registration requests to prevent resource consumption.

Fix

Related Identifiers

CVE-2006-4272

Affected Products

Vbulletin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2006-4272 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2006-08/0381.html · Note
• http://securityreason.com/securityalert/1426 · Note
• http://securityfocus.com/archive/1/443648/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4272 · Note