PT-2008-4184 · Vbulletin Solutions · Vbulletin

Jessica Hope · Published 2008-06-17 · Updated 2018-10-11 · CVE-2008-2744

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions vBulletin versions 3.6.10 through 3.7.1

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via unknown vectors, possibly through an obscure method related to the redirect parameter in the Admin Control Panel, specifically the "admincp/index.php" endpoint.

Recommendations For versions 3.6.10 and 3.7.1, consider restricting access to the Admin Control Panel to minimize the risk of exploitation until a fix is available. Avoid using the redirect parameter in the "admincp/index.php" endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-2744

Affected Products

Vbulletin

References · 10

• 🔥 http://securityfocus.com/bid/29704 · Exploit
• 🔥 https://exploit-db.com/exploits/31910 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-2744 · Security Note
• http://secunia.com/advisories/30733 · Vendor Advisory
• http://securityreason.com/securityalert/3946 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43090 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2744 · Note
• http://securitytracker.com/id?1020322 · Note
• http://securityfocus.com/archive/1/493340/100/0/threaded · Note
• http://vbulletin.com/forum/showthread.php?t=274882 · Note