CVE-2008-2744 Cross-site scripting (XSS) vulnerability in vBulletin 3.6.10 and 3.7.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors and an "obscure method." NOTE: the vector is p...
MediumCVSS 4.3
EPSS 2.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in vBulletin 3.6.10 and 3.7.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors and an "obscure method." NOTE: the vector is probably in the redirect parameter to the Admin Control Panel (admincp/index.php).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vbulletin | = 3.6.10 | No fix listed |
| vbulletin | = 3.7.1 | No fix listed |
References
- 30733 third-party-advisory vendor-advisory
- 3946 third-party-advisory
- 20080613 Exploit for vBulletin "obscure" XSS (3.7.1 & 3.6.10) mailing-list
- 29704 exploit vdb-entry
- 1020322 vdb-entry
- www.vbulletin.com
- vbulletin-redirect-xss(43090) vdb-entry