CVE-2020-17496

vBulletin PHP Module Remote Code Execution Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 87%

What it is

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.

CISA: The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This CVE ID resolves an incomplete patch for CVE-2019-16759.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: May 3, 2022

Added to the CISA list: November 3, 2021
Published: August 12, 2020
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 87% in the top 0.2% of all known vulnerabilities
Weakness: CWE-74
More details: NVD · CVE.org · CISA

All references (4)

More exploited flaws from vBulletin

Added	Vulnerability	Product	Severity	Attack chance
Nov 3, 2021	PHP Module Remote Code ExecutionCVE-2019-16759	vBulletin	Critical 9.8	99.7%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.