Back to CVE Browser

CVE-2020-12720

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.1400%

EPSS Percentile34.57th

PublishedMay 8, 2020

Last ModifiedNov 21, 2024

Vulnerability Description

vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.

Affected Platforms (CPE)

📦

Vbulletin

Vbulletin

>= 5.0.0 and < 5.5.6

📦

Vbulletin

Vbulletin

= 5.5.6

📦

Vbulletin

Vbulletin

= 5.6.0

📦

Vbulletin

Vbulletin

= 5.6.1.-

References & Advisories

🔗 http://packetstormsecurity.com/files/157716/vBulletin-5.6.1-SQL-Injection.html

🔗 http://packetstormsecurity.com/files/157904/vBulletin-5.6.1-SQL-Injection.html

🔗 https://attackerkb.com/topics/RSDAFLik92/cve-2020-12720-vbulletin-incorrect-access-control

🔗 https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4440032-vbulletin-5-6-1-security-patch-level-1

🔗 http://packetstormsecurity.com/files/157716/vBulletin-5.6.1-SQL-Injection.html

🔗 http://packetstormsecurity.com/files/157904/vBulletin-5.6.1-SQL-Injection.html

🔗 https://attackerkb.com/topics/RSDAFLik92/cve-2020-12720-vbulletin-incorrect-access-control

🔗 https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4440032-vbulletin-5-6-1-security-patch-level-1

Related Vulnerabilities

CVE-2012-432810.0

Unspecified vulnerability in the MAPI in vBulletin Suite 4.1.2 through 4.1.12, Forum 4.1.2 through 4.1.12, and the MAPI plugin 1.4...

CVE-2020-174969.8

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer...

CVE-2019-171329.8

vBulletin through 5.5.4 mishandles custom avatars.

CVE-2019-167599.8

vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php rout...