CVE-2023-25135
Summary
| CVE | CVE-2023-25135 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-02-03 05:15:00 UTC |
| Updated | 2023-02-13 14:55:00 UTC |
| Description | vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then checking for errors. The fixed versions are 5.6.7 PL1, 5.6.8 PL1, and 5.6.9 PL1. |
Risk And Classification
Problem Types: CWE-502
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Unserializable, but unreachable: Remote code execution on vBulletin | MISC | www.ambionics.io | |
| vBulletin 5.6.9 Security Patch - vBulletin Community Forum | MISC | forum.vbulletin.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 731098 vBulletin Remote Code Execution Vulnerability (CVE-2023-25135)