Back to CVE Browser

CVE-2019-17132

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.0450%

EPSS Percentile6.67th

PublishedOct 4, 2019

Last ModifiedNov 21, 2024

Vulnerability Description

vBulletin through 5.5.4 mishandles custom avatars.

Affected Platforms (CPE)

📦

Vbulletin

Vbulletin

<= 5.5.4

References & Advisories

🔗 http://packetstormsecurity.com/files/154759/vBulletin-5.5.4-Remote-Code-Execution.html

🔗 http://seclists.org/fulldisclosure/2019/Oct/9

🔗 https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4423646-vbulletin-5-5-x-5-5-2-5-5-3-and-5-5-4-security-patch-level-2

🔗 http://packetstormsecurity.com/files/154759/vBulletin-5.5.4-Remote-Code-Execution.html

🔗 http://seclists.org/fulldisclosure/2019/Oct/9

🔗 https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4423646-vbulletin-5-5-x-5-5-2-5-5-3-and-5-5-4-security-patch-level-2

Related Vulnerabilities

CVE-2012-432810.0

Unspecified vulnerability in the MAPI in vBulletin Suite 4.1.2 through 4.1.12, Forum 4.1.2 through 4.1.12, and the MAPI plugin 1.4...

CVE-2020-174969.8

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer...

CVE-2019-167599.8

vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php rout...

CVE-2020-127209.8

vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.