vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
vBulletin, a widely used forum and community software platform, is affected by this vulnerability. An attacker could send a specially crafted request to the software's tab panel rendering feature, allowing them to run arbitrary commands on the affected server.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a n/a
Version range not reported
References 4
cwe.mitre.org
blog.exploitee.rs
forum.vbulletin.com
seclists.org
Questions about CVE-2020-17496
What does this mean?
Crafted subWidgets data sent to the ajax/render/widget_tabbedcontainer_tab_panel endpoint of vBulletin 5 can lead to remote code execution on the server.Source: blog.exploitee.rs
Am I affected, and how do I check?
The checked facts say the bug affects the latest vBulletin 5 software, but they do not list specific versions. To check an installation, look up the vBulletin version in its admin control panel and compare it with the vendor's advisory.Source: blog.exploitee.rs
What should I do about it?
The checked facts do not name a fixed version. The supplied patch was found inadequate, so check the vendor's advisory for a newer fix before relying on the current version.Source: blog.exploitee.rs
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-11-03, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data
What if there's no patch?
The checked facts record no workaround. Until a complete fix is confirmed, the facts give no specific steps to limit exposure.Source: blog.exploitee.rs
Is the fix complete?
The advisory says the patch supplied for this vulnerability was inadequate in blocking the problem, so the fix is not complete.Source: blog.exploitee.rs