CVE-2015-3419

vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations via vectors related to an input validation failure.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 38%
VendorProductVersion
vbulletinvbulletin
5.0.0:beta_11
vbulletinvbulletin
5.0.0:beta_28
vbulletinvbulletin
5.0.1
vbulletinvbulletin
5.0.2
vbulletinvbulletin
5.0.3
vbulletinvbulletin
5.0.4
vbulletinvbulletin
5.0.5
vbulletinvbulletin
5.1.0
vbulletinvbulletin
5.1.0:rc1
vbulletinvbulletin
5.1.1
vbulletinvbulletin
5.1.2:beta1
vbulletinvbulletin
5.1.2:rc1
vbulletinvbulletin
5.1.2:rc2
vbulletinvbulletin
5.1.3
vbulletinvbulletin
5.1.3:alpha5
vbulletinvbulletin
5.1.3:rc1
vbulletinvbulletin
5.1.4
vbulletinvbulletin
5.1.4:rc1
vbulletinvbulletin
5.1.5
vbulletinvbulletin
5.1.5:beta_1
vbulletinvbulletin
5.1.5:beta_3
vbulletinvbulletin
5.1.6
vbulletinvbulletin
5.1.6:beta_2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.openwall.com/lists/oss-security/2015/04/24/4
http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4319488-security-patch-released-for-vbulletin-5-1-4-5-1-6-and-vbulletin-cloud
http://www.openwall.com/lists/oss-security/2015/04/24/4
http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4319488-security-patch-released-for-vbulletin-5-1-4-5-1-6-and-vbulletin-cloud