CVE-2023-25135: Critical severity vbulletin vulnerability

Published Feb 3, 2023

Updated

vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verifyserialized checks that a value is serialized by calling unserialize and then checking for errors. The fixed versions are 5.6.7 PL1, 5.6.8 PL1, and 5.6.9 PL1.

Affected Software

4 affected components

vBulletin vBulletin=5.6.7

vBulletin vBulletin=5.6.8

vBulletin vBulletin=5.6.9

WP Engine Better Search Replace=1.4.4

Event History

Feb 3, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·05:15 AM

DescriptionSeverityWeaknessAffected Software

Jan 25, 2024

News Published

via BleepingComputer·02:15 PM

Jan 29, 2024

News Published

via BleepingComputer·02:18 PM

Peer vulnerabilities

Found alongside the following vulnerabilities.

CVE-2023-6933

Frequently Asked Questions

What is the vulnerability ID for this security issue in vBulletin?

The vulnerability ID for this security issue in vBulletin is CVE-2023-25135.

What is the impact of the vulnerability CVE-2023-25135 in vBulletin?

The impact of the vulnerability CVE-2023-25135 in vBulletin is that an unauthenticated remote attacker can execute arbitrary code.

How does the vulnerability CVE-2023-25135 in vBulletin occur?

The vulnerability CVE-2023-25135 in vBulletin occurs due to a crafted HTTP request that triggers deserialization.

Is authentication required for the exploitation of CVE-2023-25135 in vBulletin?

No, authentication is not required for the exploitation of CVE-2023-25135 in vBulletin.

How can I fix the vulnerability CVE-2023-25135 in vBulletin?

To fix the vulnerability CVE-2023-25135 in vBulletin, update to the fixed versions which are 5.6.9 PL1 or later.