Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveRapid7CVE-2020-7373
HistoryOct 30, 2020 - 5:15 p.m.

CVE-2020-7373

2020-10-3017:15:12
CWE-94
rapid7
web.nvd.nist.gov
82
cve-2020-7373
vbulletin
remote command execution
ajax
cve-2019-16759
cve-2020-17496

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.975

Percentile

100.0%

JSON

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is the preferred CVE ID to track this vulnerability.

Affected configurations

Nvd
Node
vbulletinvbulletinRange5.5.4–5.6.2
VendorProductVersionCPE
vbulletinvbulletin*cpe:2.3:a:vbulletin:vbulletin:*:*:*:*:*:*:*:*

Related

prion 3
cvelist 3
nvd 3
attackerkb 4
openvas 2
zdt 4
nuclei 2
packetstorm 6
checkpoint_advisories 2
cisa_kev 2
githubexploit 11
nessus 2
cve 2
metasploit 2
threatpost 4
thn 6
exploitdb 3
canvas 1
impervablog 2
exploitpack 1
mssecure 1
qualysblog 1
prion
prion
Design/Logic Flaw
2020-10-30 17:15:00
Design/Logic Flaw
2020-08-12 14:15:00
Cross site request forgery (csrf)
2019-09-24 22:15:00
cvelist
cvelist
CVE-2020-7373
2020-10-30 16:50:16
CVE-2020-17496
2020-08-12 13:07:58
CVE-2019-16759
2019-09-24 21:01:49
nvd
nvd
CVE-2020-7373
2020-10-30 17:15:12
CVE-2020-17496
2020-08-12 14:15:13
CVE-2019-16759
2019-09-24 22:15:13
attackerkb
attackerkb
CVE-2020-7373
2020-10-30 00:00:00
CVE-2020-17496
2020-08-12 00:00:00
CVE-2019-16759
2019-09-24 00:00:00
openvas
openvas
vBulletin 5.x RCE Vulnerability
2020-08-10 00:00:00
vBulletin 5.x < 5.5.2 Patch Level 1, 5.5.3 < 5.5.3 Patch Level 1, 5.5.4 < 5.5.4 Patch Level 1 RCE Vulnerability
2019-09-25 00:00:00
zdt
zdt
vBulletin 5.x Remote Code Execution Exploit
2020-08-12 00:00:00
vBulletin 5.5.4 Remote Command Execution Exploit #RCE
2019-12-11 00:00:00
vBulletin 5.6.2 - (widget_tabbedContainer_tab_panel) Remote Code Execution Exploit
2020-08-12 00:00:00
nuclei
nuclei
vBulletin 5.0.0-5.5.4 - Remote Command Execution
2020-07-04 15:56:10
vBulletin 5.5.4 - 5.6.2- Remote Command Execution
2021-02-24 20:00:52
packetstorm
packetstorm
vBulletin 5.x Remote Code Execution
2020-08-13 00:00:00
vBulletin 5.x Pre-Auth Remote Code Execution
2019-09-28 00:00:00
vBulletin 5.x Remote Code Execution
2020-08-11 00:00:00
checkpoint_advisories
checkpoint_advisories
VBulletin Remote Code Execution (CVE-2020-7373)
2020-11-25 00:00:00
vBulletin Forum Remote Code Execution (CVE-2019-16759; CVE-2020-17496)
2019-09-25 00:00:00
cisa_kev
cisa_kev
vBulletin PHP Module Remote Code Execution Vulnerability
2021-11-03 00:00:00
vBulletin PHP Module Remote Code Execution Vulnerability
2021-11-03 00:00:00
githubexploit
githubexploit
Exploit for Injection in Vbulletin
2020-08-20 12:20:03
Exploit for Code Injection in Vbulletin
2020-08-24 16:15:10
Exploit for Injection in Vbulletin
2020-09-03 14:41:29
nessus
nessus
vBulletin CVE-2019-16759 Bypass Remote Code Execution (CVE-2020-17496) (direct check)
2020-08-10 00:00:00
vBulletin 'widget_php' Command Execution
2019-10-23 00:00:00
cve
cve
CVE-2020-17496
2020-08-12 14:15:13
CVE-2019-16759
2019-09-24 22:15:13
metasploit
metasploit
vBulletin 5.x /ajax/render/widget_tabbedcontainer_tab_panel PHP remote code execution.
2020-08-09 22:38:52
vBulletin widgetConfig RCE
2019-10-18 11:51:58
threatpost
threatpost
vBulletin Flaw Exploited in Dutch Sex-Work Forum Breach
2019-10-10 20:37:40
Rash of Exploits Targets Critical vBulletin RCE Bug
2019-09-26 17:45:03
Gitpaste-12 Worm Widens Set of Exploits in New Attacks
2020-12-15 21:29:51
thn
thn
Comodo Forums Hack Exposes 245,000 Users' Data — Recent vBulletin 0-day Used
2019-10-01 11:23:00
Hackers Breach ZoneAlarm's Forum Site — Outdated vBulletin to Blame
2019-11-11 15:27:00
[Unpatched] Critical 0-Day RCE Exploit for vBulletin Forum Disclosed Publicly
2019-09-24 18:57:00
exploitdb
exploitdb
vBulletin 5.x - Remote Command Execution (Metasploit)
2019-09-30 00:00:00
vBulletin 5.6.2 - &#039;widget_tabbedContainer_tab_panel&#039; Remote Code Execution
2020-08-12 00:00:00
vBulletin 5.0 &lt; 5.5.4 - &#039;widget_php &#039; Unauthenticated Remote Code Execution
2019-09-23 00:00:00
canvas
canvas
Immunity Canvas: VBULLETIN_WIDGET_RCE
2019-09-24 22:15:00
impervablog
impervablog
Attackers Are Quick to Exploit vBulletin’s Latest 0-day Remote Code Execution Vulnerability
2019-09-26 13:43:30
CrimeOps of the KashmirBlack Botnet – Part II
2020-10-22 18:55:05
exploitpack
exploitpack
vBulletin 5.x - Remote Command Execution (Metasploit)
2019-09-30 00:00:00
mssecure
mssecure
Ghost in the shell: Investigating web shell attacks
2020-02-04 17:30:40
qualysblog
qualysblog
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR
2022-02-23 05:39:00

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.975

Percentile

100.0%

JSON
Related for CVE-2020-7373
prion3cvelist3nvd3attackerkb4openvas2zdt4nuclei2packetstorm6checkpoint_advisories2cisa_kev2githubexploit11nessus2cve2metasploit2threatpost4thn6exploitdb3canvas1impervablog2exploitpack1mssecure1qualysblog1