CVE-2016-6483 The media-file upload feature in vBulletin before 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2, 3.8.9 before Patch Level 1, 4.x before 4.2.2 Patch Level 6, 4.2.3 before Patch Level 2, 5.x before 5....
HighCVSS 8.6
EPSS 12.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The media-file upload feature in vBulletin before 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2, 3.8.9 before Patch Level 1, 4.x before 4.2.2 Patch Level 6, 4.2.3 before Patch Level 2, 5.x before 5.2.0 Patch Level 3, 5.2.1 before Patch Level 1, and 5.2.2 before Patch Level 1 allows remote attackers to conduct SSRF attacks via a crafted URL that results in a Redirection HTTP status code.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vbulletin | = 3.8.7 | No fix listed |
| vbulletin | = 3.8.8 | No fix listed |
| vbulletin | = 3.8.9 | No fix listed |
| vbulletin | = 4.2.2 | No fix listed |
| vbulletin | = 4.2.3 | No fix listed |
| vbulletin | = 5.2.0 | No fix listed |
| vbulletin | = 5.2.1 | No fix listed |
| vbulletin | = 5.2.2 | No fix listed |
References
- legalhackers.com exploit third-party-advisory
- 92350 vdb-entry
- 1036553 vdb-entry
- www.vbulletin.com patch
- www.vbulletin.com patch
- www.vbulletin.com patch
- 40225 exploit