CVE-2014-9438 - CVE House
Back to Database
Status published Medium CVE-2014-9438

Cross-site request forgery (CSRF) vulnerability in the Moderator Control Panel...

Vulnerability Description

Cross-site request forgery (CSRF) vulnerability in the Moderator Control Panel in vBulletin 4.2.2 allows remote attackers to hijack the authentication of administrators for requests that (1) ban a user via the username parameter in a dobanuser action to modcp/banning.php or (2) unban a user, (3) modify user profiles, edit a (4) post or (5) topic, or approve a (6) post or (7) topic via unspecified vectors.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2014-9438

Credits & Attribution

No credits recorded in the NVD database.

References

More from vbulletin

View All →
CVE-2020-7373
vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted...
Critical 9.8
CVE-2020-25124
The Admin CP in vBulletin 5.6.3 allows XSS via an...
Medium 4.8
CVE-2020-25123
The Admin CP in vBulletin 5.6.3 allows XSS via a...
Medium 4.8
CVE-2020-25122
The Admin CP in vBulletin 5.6.3 allows XSS via a...
Medium 4.8
CVE-2020-25121
The Admin CP in vBulletin 5.6.3 allows XSS via the...
Medium 4.8

Affected Vendor

Affected Software

vbulletin
Vulnerable Versions:
4.2.2

Timeline

Official Publish: January 2nd, 2015
Last Modified: August 6th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.