9.8Critical
KEV
CVE-2019-16759vBulletin PHP Module Remote Code Execution Vulnerability
Known exploited — vBulletin PHP Module Remote Code Execution Vulnerability
CISA confirmed this vulnerability is used in real attacks on 03.11.2021. Remediation deadline for US federal agencies: 03.05.2022.
Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2019-16759
Description
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.
Weakness (CWE):
CWE-94
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
References and patches
- https://seclists.org/fulldisclosure/2019/Sep/31 ExploitMailing ListThird Party Advisory
- https://www.theregister.co.uk/2019/09/24/vbulletin_vbug_zeroday/ Press/Media CoverageThird Party Advisory
- https://arstechnica.com/information-technology/2019/09/public-exploit-code-spawns-mass-attacks-against-high-s… ExploitPress/Media CoverageThird Party Advisory
- http://packetstormsecurity.com/files/154623/vBulletin-5.x-0-Day-Pre-Auth-Remote-Command-Execution.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/154648/vBulletin-5.x-Pre-Auth-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/155633/vBulletin-5.5.4-Remote-Command-Execution.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/158830/vBulletin-5.x-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/158829/vBulletin-5.x-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- 20200811 Remote Code Execution 0day in vBulletin 5.x mailing-listExploitMailing ListThird Party Advisory
- http://packetstormsecurity.com/files/158866/vBulletin-5.x-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16759 US Government Resource
CPE matches (NVD) (1)
cpe:2.3:a:vbulletin:vbulletin:*:*:*:*:*:*:*:*≥ 5.0.0 ≤ 5.5.4