CVE-2007-3326: XSS
Multiple directory traversal vulnerabilities in vBulletin 3.x.x allow remote attackers to redirect visitors to arbitrary local files via a .. (dot dot) in (1) the loc parameter to admincp/index.php and (2) the Hyperlink information URl field for post Topic in showthread.php, enabling cross-site scripting (XSS) and other attacks, a different vulnerability than CVE-2005-3025.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-3326?
CVE-2007-3326 is classified as a high severity vulnerability due to its potential to allow unauthorized access to local files.
How do I fix CVE-2007-3326?
To fix CVE-2007-3326, it is recommended to upgrade to the latest version of vBulletin that addresses this vulnerability.
What software versions are affected by CVE-2007-3326?
CVE-2007-3326 affects vBulletin versions 3.0.0 and potentially other 3.x.x versions.
What types of attacks can be executed due to CVE-2007-3326?
CVE-2007-3326 can be exploited to conduct directory traversal attacks allowing remote attackers to access arbitrary local files.
Can CVE-2007-3326 lead to cross-site scripting vulnerabilities?
Yes, CVE-2007-3326 can lead to cross-site scripting vulnerabilities through the exploitation of the redirect feature.