CVE-2020-7373

Katalog CVE

CVSS 9.8 · Critical EPSS 45,0%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada vbulletin. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is the preferred CVE ID to track this vulnerability.

Rincian

Terbit di NVD

30 Oktober 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

45,0% peluang dieksploitasi; lebih tinggi dari 98,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4445227-vbulletin-5-6-0-5... patch · advisory vendor
• https://github.com/rapid7/metasploit-framework/pull/13970 patch · advisory pihak ketiga
• https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/ exploit · advisory pihak ketiga
• https://seclists.org/fulldisclosure/2020/Aug/5 exploit · mailing list · advisory pihak ketiga