CVE-2014-3135: XSS
Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 5.1.1 Alpha 9 allow remote attackers to inject arbitrary web script or HTML via (1) the PATHINFO to privatemessage/new/, (2) the folderid parameter to a private message in privatemessage/view, (3) a fragment indicator to /help, or (4) the view parameter to a topic, as demonstrated by a request to forum/anunturi-importante/rst-power/67030-rst-admin-restore.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3135?
CVE-2014-3135 is classified as a medium severity vulnerability due to its potential to allow cross-site scripting attacks.
How do I fix CVE-2014-3135?
To fix CVE-2014-3135, update vBulletin to a version that has patched these XSS vulnerabilities.
What types of attacks are possible with CVE-2014-3135?
CVE-2014-3135 allows remote attackers to perform cross-site scripting attacks, potentially injecting arbitrary web scripts or HTML.
Which versions of vBulletin are affected by CVE-2014-3135?
CVE-2014-3135 specifically affects vBulletin version 5.1.1 Alpha 9.
What components of vBulletin are impacted by CVE-2014-3135?
The vulnerabilities in CVE-2014-3135 impact several components including the private message functionality and help pages.