vBulletin PHP Module Remote Code Execution Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-11-03
• EPSS: 87% chance of exploitation in the next 30 days (higher than 100% of CVEs)
• Critical severity: CVSS 9.8

[ Description ]Official description

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.

CISA: The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This CVE ID resolves an incomplete patch for CVE-2019-16759.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 3 May 2022): Apply updates per vendor instructions.

• Patch on forum.vbulletin.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-failExploitThird Party Advisory
• cwe.mitre.org/data/definitions/78.htmlTechnical Description
• forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4445227-vb…PatchVendor Advisory
• seclists.org/fulldisclosure/2020/Aug/5ExploitMailing ListThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource