漏洞描述
vBulletin versions 5.5.4 through 5.6.2 allow remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
www.tenable.comhttps://www.tenable.com/blog/zero-day-remote-code-execution-vulnerability-in-vbulletin-disclosed↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2020-17496↗seclists.orghttps://seclists.org/fulldisclosure/2020/Aug/5↗forum.vbulletin.comhttps://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4445227-vbulletin-5-6-0-5-6-1-5-6-2-security-patch↗cwe.mitre.orghttps://cwe.mitre.org/data/definitions/78.html↗