CVE-2016-6483: SSRF
First published: Fri Sep 02 2016(Updated: )
The media-file upload feature in vBulletin before 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2, 3.8.9 before Patch Level 1, 4.x before 4.2.2 Patch Level 6, 4.2.3 before Patch Level 2, 5.x before 5.2.0 Patch Level 3, 5.2.1 before Patch Level 1, and 5.2.2 before Patch Level 1 allows remote attackers to conduct SSRF attacks via a crafted URL that results in a Redirection HTTP status code.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| vBulletin vBulletin | =3.8.7 | |
| vBulletin vBulletin | =3.8.8 | |
| vBulletin vBulletin | =3.8.9 | |
| vBulletin vBulletin | =4.2.2 | |
| vBulletin vBulletin | =4.2.3 | |
| vBulletin vBulletin | =5.2.0 | |
| vBulletin vBulletin | =5.2.1 | |
| vBulletin vBulletin | =5.2.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://legalhackers.com/advisories/vBulletin-SSRF-Vulnerability-Exploit.txt
- http://www.securityfocus.com/bid/92350
- http://www.securitytracker.com/id/1036553
- http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4349548-security-patch-vbulletin-3-8-7-3-8-8-3-8-9-3-8-10-beta
- http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4349549-security-patch-vbulletin-4-2-2-4-2-3-4-2-4-beta
- http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4349551-security-patch-vbulletin-5-2-0-5-2-1-5-2-2
- https://www.exploit-db.com/exploits/40225/
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/severity
- agent/remedy
- agent/author
- agent/last-modified-date
- agent/softwarecombine
- agent/description
- agent/first-publish-date
- agent/tags
- agent/event
- vendor/vbulletin
- canonical/vbulletin vbulletin
- version/vbulletin vbulletin/3.8.7
- version/vbulletin vbulletin/3.8.8
- version/vbulletin vbulletin/3.8.9
- version/vbulletin vbulletin/4.2.2
- version/vbulletin vbulletin/4.2.3
- version/vbulletin vbulletin/5.2.0
- version/vbulletin vbulletin/5.2.1
- version/vbulletin vbulletin/5.2.2