CVE-2020-17496

vbulletin

Published 12 Aug 2020 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 3 Nov 2021, with a remediation deadline of 3 May 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.

References

blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/ · Exploit, Third Party Advisory
cwe.mitre.org/data/definitions/78.html · Technical Description
forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4445227-vbulletin-5-6-0-5-6-1-5-6-2-security-patch · Patch, Vendor Advisory
seclists.org/fulldisclosure/2020/Aug/5 · Exploit, Mailing List, Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-17496 · US Government Resource