CVE-2020-17496: vBulletin PHP Module Remote Code Execution Vulnerability

CVE-2020-17496 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2021-11-03

The PHP module in vBulletin allows for remote code execution due to improper neutralization of special elements in subWidgets data. An attacker can trigger this via a specially crafted ajax/render/widget_tabbedcontainer_tab_panel request, bypassing an incomplete patch for CVE-2019-16759.

Technologies: Vbulletin. Vendors: Vbulletin.

Quick answers

Is CVE-2020-17496 exploited in the wild?
Yes. CVE-2020-17496 is known to be exploited in the wild, first recorded on 3 November 2021. Treat it as urgent.
How severe is CVE-2020-17496?
Critical severity, with a CVSS score of 9.8, published 3 November 2021.
Which products and versions are affected?
vBulletin vBulletin 5.5.4 through 5.6.2.
Is there a fix for CVE-2020-17496?
A patch was published on 2020-08-17: NIST analysis notes vendor security patch availability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-17496 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2020-17496?
Check whether you run Vbulletin. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

  • vBulletin vBulletin 5.5.4 through 5.6.2

Timeline

  • 2020-08-12: disclosed: NVD Published Date
  • 2021-11-03: kev added: Date added to CISA Known Exploited Vulnerabilities Catalog
  • exploited: Reported as exploited in the wild and included in CISA KEV catalog.
  • 2020-08-17: patched: NIST analysis notes vendor security patch availability.

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.