CVE-2008-3773 Cross-site scripting (XSS) vulnerability in vBulletin 3.7.2 PL1 and 3.6.10 PL3, when "Show New Private Message Notification Pop-Up" is enabled, allows remote authenticated users to inject arbitrary we...
MediumCVSS 4.3
EPSS 3.8%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in vBulletin 3.7.2 PL1 and 3.6.10 PL3, when "Show New Private Message Notification Pop-Up" is enabled, allows remote authenticated users to inject arbitrary web script or HTML via a private message subject (aka newpm[title]).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vbulletin | = 3.6.10-pl3 | No fix listed |
| vbulletin | = 3.7.2-pl1 | No fix listed |
References
- 20080820 CORE-2008-0813 - vBulletin Cross Site Scripting Vulnerability mailing-list patch
- 31552 third-party-advisory vendor-advisory
- 4182 third-party-advisory
- www.coresecurity.com patch
- 30777 vdb-entry
- 1020727 vdb-entry
- www.vbulletin.com patch
- vbulletin-message-xss(44576) vdb-entry