CVE-2016-6483

Published: Sep 2, 2016Modified: May 6, 2026

8.6

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 4.0

Source: NVD

Description

The media-file upload feature in vBulletin before 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2, 3.8.9 before Patch Level 1, 4.x before 4.2.2 Patch Level 6, 4.2.3 before Patch Level 2, 5.x before 5.2.0 Patch Level 3, 5.2.1 before Patch Level 1, and 5.2.2 before Patch Level 1 allows remote attackers to conduct SSRF attacks via a crafted URL that results in a Redirection HTTP status code.

Affected (8)

Products: Vbulletin: Vbulletin

1 product

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Vbulletin Vbulletin	Version 3.8.7
Vbulletin Vbulletin	Version 3.8.8
Vbulletin Vbulletin	Version 3.8.9
Vbulletin Vbulletin	Version 4.2.2
Vbulletin Vbulletin	Version 4.2.3
Vbulletin Vbulletin	Version 5.2.0
Vbulletin Vbulletin	Version 5.2.1
Vbulletin Vbulletin	Version 5.2.2

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (14)

http://legalhackers.com/advisories/vBulletin-SSRF-Vulnerability-Exploit.txt

Source: cve@mitre.org

ExploitThird Party Advisory

http://www.securityfocus.com/bid/92350

Source: cve@mitre.org

http://www.securitytracker.com/id/1036553

Source: cve@mitre.org

http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4349548-security-patch-vbulletin-3-8-7-3-8-8-3-8-9-3-8-10-beta

Source: cve@mitre.org

Patch

http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4349549-security-patch-vbulletin-4-2-2-4-2-3-4-2-4-beta

Source: cve@mitre.org

Patch

http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4349551-security-patch-vbulletin-5-2-0-5-2-1-5-2-2

Source: cve@mitre.org

Patch

https://www.exploit-db.com/exploits/40225/

Source: cve@mitre.org

http://legalhackers.com/advisories/vBulletin-SSRF-Vulnerability-Exploit.txt

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

http://www.securityfocus.com/bid/92350

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id/1036553

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4349548-security-patch-vbulletin-3-8-7-3-8-8-3-8-9-3-8-10-beta

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4349549-security-patch-vbulletin-4-2-2-4-2-3-4-2-4-beta

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4349551-security-patch-vbulletin-5-2-0-5-2-1-5-2-2

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://www.exploit-db.com/exploits/40225/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.