Actively exploited · Published Aug 12, 2020 · Assigned by mitre

CVE-2020-17496

Critical 9.8 Exploited

In plain English

A critical-severity injection in vBulletin from vBulletin. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 87.5% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)87.5%top 0.2% of all CVEs

Exploited in the wildYesCISA KEV since Nov 3, 2021

Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://cwe.mitre.org/data/definitions/78.html x_refsource_MISC
https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/ x_refsource_MISC
https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4445227-vbulletin-5-6-0-5-6-1-5-6-2-security-patch x_refsource_MISC
https://seclists.org/fulldisclosure/2020/Aug/5 x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-17496 government-resource