The media-file upload feature in vBulletin prior to 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2, 3.8.9 before Patch Level 1, 4.x prior to 4.2.2 Patch Level 6, 4.2.3 before Patch Level 2, 5.x prior to 5.2.0 Patch Level 3, 5.2.1 before Patch Level 1, and 5.2.2 before Patch Level 1 allows remote malicious users to conduct SSRF attacks via a crafted URL that results in a Redirection HTTP status code.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
vbulletin vbulletin 4.2.3 |
||
vbulletin vbulletin 3.8.8 |
||
vbulletin vbulletin 5.2.2 |
||
vbulletin vbulletin 4.2.2 |
||
vbulletin vbulletin 3.8.9 |
||
vbulletin vbulletin 3.8.7 |
||
vbulletin vbulletin 5.2.0 |
||
vbulletin vbulletin 5.2.1 |
Is this how the Dota 2 message board was pwned?
If you've got a vBulletin forum, get patching – another security flaw has been found in the widely used web message board software. The patches address a pre-authentication server-side request forgery vulnerability (CVE-2016-6483) in vBulletin 3.8.9, 3.8.10 beta, 4.2.3, 4.2.4 beta, and 5.2.3. Attackers can exploit the bug to get access to services such as email, the memory cache, and other services. In this advisory, Dawid Golunski, who found the programming blunder, revealed that an “unauth...
Vulmon