{"id":"CVE-2020-7373","published":"2020-10-30T16:50:16Z","modified":"2024-08-04T09:25:49Z","title":"vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an…","vendor":null,"product":null,"tier":"tail","description":{"text":"vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is the preferred CVE ID to track this vulnerability.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.45007,"percentile":0.98775,"provenance":"source"},"cwes":[],"references":[{"url":"https://blog.exploitee.rs/2020/exploiting-vbulletin-a-tale-of-patch-fail/","tags":["x_refsource_MISC"]},{"url":"https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4445227-vbulletin-5-6-0-5-6-1-5-6-2-security-patch","tags":["x_refsource_MISC"]},{"url":"https://seclists.org/fulldisclosure/2020/Aug/5","tags":["x_refsource_MISC"]},{"url":"https://github.com/rapid7/metasploit-framework/pull/13970","tags":["x_refsource_MISC"]}],"priority":{"score":19.8,"factors":[{"name":"EPSS percentile","points":19.75}]},"euvd":{"id":"EUVD-2020-28500","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-vbulletin-cve-2019-16759","parents":[{"from":"CVE-2019-16759","to":"CVE-2020-7373","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.","from":"CVE.org","in":"CVE-2020-7373"}]}]}}