CVEvulnerability
CVE-2016-6483
8.6 HIGH
Official page ↗
- Status
- Modified
- Published
- 2016-09-02
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.6 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-918
Description
The media-file upload feature in vBulletin before 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2, 3.8.9 before Patch Level 1, 4.x before 4.2.2 Patch Level 6, 4.2.3 before Patch Level 2, 5.x before 5.2.0 Patch Level 3, 5.2.1 before Patch Level 1, and 5.2.2 before Patch Level 1 allows remote attackers to conduct SSRF attacks via a crafted URL that results in a Redirection HTTP status code.
Affected configurations
• vbulletin vbulletin 3.8.7
• vbulletin vbulletin 3.8.8
• vbulletin vbulletin 3.8.9
• vbulletin vbulletin 4.2.2
• vbulletin vbulletin 4.2.3
• vbulletin vbulletin 5.2.0
• vbulletin vbulletin 5.2.1
• vbulletin vbulletin 5.2.2
Related
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness
References
- http://legalhackers.com/advisories/vBulletin-SSRF-Vulnerability-Exploit.txt Exploit, Third Party Advisory
- http://www.securityfocus.com/bid/92350 www.securityfocus.com
- http://www.securitytracker.com/id/1036553 www.securitytracker.com
- http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4349548-security-patch-vbulletin-3-8-7-3-8-8-3-8-9-3-8-10-beta Patch
- http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4349549-security-patch-vbulletin-4-2-2-4-2-3-4-2-4-beta Patch
- http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4349551-security-patch-vbulletin-5-2-0-5-2-1-5-2-2 Patch
- https://www.exploit-db.com/exploits/40225/ www.exploit-db.com
- http://legalhackers.com/advisories/vBulletin-SSRF-Vulnerability-Exploit.txt Exploit, Third Party Advisory
- http://www.securityfocus.com/bid/92350 www.securityfocus.com
- http://www.securitytracker.com/id/1036553 www.securitytracker.com
- http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4349548-security-patch-vbulletin-3-8-7-3-8-8-3-8-9-3-8-10-beta Patch
- http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4349549-security-patch-vbulletin-4-2-2-4-2-3-4-2-4-beta Patch
- http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4349551-security-patch-vbulletin-5-2-0-5-2-1-5-2-2 Patch
- https://www.exploit-db.com/exploits/40225/ www.exploit-db.com