SB2020103046 - Command Injection in vBulletin
Published: October 30, 2020 Updated: December 16, 2020
Security Bulletin ID
SB2020103046
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Command Injection (CVE-ID: CVE-2020-7373)
The vulnerability allows a remote attacker to execute arbitrary commands on the target system.
The vulnerability exists due to improper input validation in subWidgets data in an "ajax/render/widget_tabbedcontainer_tab_panel" request. A remote attacker can pass specially crafted data to the application and execute arbitrary commands on the target system.
Remediation
Install update from vendor's website.
References
- https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/
- https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4445227-vbulletin-5-6-0-5-6-1-5-6-2-security-patch
- https://github.com/rapid7/metasploit-framework/pull/13970
- https://seclists.org/fulldisclosure/2020/Aug/5