CVE-2016-6483
Summary
| CVE | CVE-2016-6483 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2016-09-02 01:59:03 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | The media-file upload feature in vBulletin before 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2, 3.8.9 before Patch Level 1, 4.x before 4.2.2 Patch Level 6, 4.2.3 before Patch Level 2, 5.x before 5.2.0 Patch Level 3, 5.2.1 before Patch Level 1, and 5.2.2 before Patch Level 1 allows remote attackers to conduct SSRF attacks via a crafted URL that results in a Redirection HTTP status code. |
Risk And Classification
Primary CVSS: v3.0 8.6 HIGH from [email protected]
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
EPSS: 0.162620000 probability, percentile 0.948540000 (date 2026-05-06)
Problem Types: CWE-918 | n/a
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.0 | [email protected] | Primary | 8.6 | HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N |
| 2.0 | [email protected] | Primary | 5 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
CVSS v3.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
ChangedConfidentiality
NoneIntegrity
HighAvailability
NoneCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:L/Au:N/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Vbulletin | Vbulletin | 3.8.7 | All | All | All |
| Application | Vbulletin | Vbulletin | 3.8.8 | All | All | All |
| Application | Vbulletin | Vbulletin | 3.8.9 | All | All | All |
| Application | Vbulletin | Vbulletin | 4.2.2 | All | All | All |
| Application | Vbulletin | Vbulletin | 4.2.3 | All | All | All |
| Application | Vbulletin | Vbulletin | 5.2.0 | All | All | All |
| Application | Vbulletin | Vbulletin | 5.2.1 | All | All | All |
| Application | Vbulletin | Vbulletin | 5.2.2 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Security Patch - vBulletin 3.8.7, 3.8.8, 3.8.9, 3.8.10 Beta - vBulletin Community Forum | af854a3a-2127-422b-91ae-364da2661108 | www.vbulletin.com | Patch |
| vBulletin CVE-2016-6483 Server Side Request Forgery Security Bypass Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| vBulletin Input Validation Flaw in Media Upload Function Lets Remote Users Conduct Server-Side Request Forgery Attacks - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| vBulletin 5.2.2 - Preauth Server Side Request Forgery (SSRF) | af854a3a-2127-422b-91ae-364da2661108 | www.exploit-db.com | |
| Security Patch - vBulletin 4.2.2, 4.2.3, 4.2.4 Beta - vBulletin Community Forum | af854a3a-2127-422b-91ae-364da2661108 | www.vbulletin.com | Patch |
| legalhackers.com/advisories/vBulletin-SSRF-Vulnerability-Exploit.txt | af854a3a-2127-422b-91ae-364da2661108 | legalhackers.com | Exploit, Third Party Advisory |
| Security Patch - vBulletin 5.2.0, 5.2.1, 5.2.2 - vBulletin Community Forum | af854a3a-2127-422b-91ae-364da2661108 | www.vbulletin.com | Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.