CVE-2014-9463: Code Injection
Published Sep 15, 2017
·Updated
functionsvbseohook.php in the VBSEO module for vBulletin allows remote authenticated users to execute arbitrary code via the HTTP Referer header to visitormessage.php.
Affected Software
2 affected components
vbseo vbseo
vBulletin vBulletin<=4.2.2
Event History
Sep 15, 2017
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-9463?
CVE-2014-9463 is considered a high severity vulnerability due to the ability for remote authenticated users to execute arbitrary code.
2
How do I fix CVE-2014-9463?
To fix CVE-2014-9463, update the VBSEO module and vBulletin to versions that have patched this vulnerability.
3
What software is affected by CVE-2014-9463?
CVE-2014-9463 affects the VBSEO module for vBulletin versions up to and including 4.2.2.
4
What kind of attack does CVE-2014-9463 allow?
CVE-2014-9463 allows remote authenticated users to exploit the vulnerability through the HTTP Referer header to execute arbitrary code.
5
Who can exploit CVE-2014-9463?
CVE-2014-9463 can be exploited by remote authenticated users with access to the affected vBulletin forums.