CVE-2017-17671 - CVE House
Back to Database
Status published Critical CVE-2017-17671

vBulletin through 5.3.x on Windows allows remote PHP code execution...

Vulnerability Description

vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request that can include directory traversal sequences to specify an arbitrary pathname, and because ../ traversal is blocked but ..\ traversal is not blocked. For example, an attacker can make an invalid HTTP request containing PHP code, and then make an index.php?routestring= request with enough instances of ".." to reach an Apache HTTP Server log file.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-17671

Credits & Attribution

No credits recorded in the NVD database.

References

More from vbulletin

View All →
CVE-2020-7373
vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted...
Critical 9.8
CVE-2020-25124
The Admin CP in vBulletin 5.6.3 allows XSS via an...
Medium 4.8
CVE-2020-25123
The Admin CP in vBulletin 5.6.3 allows XSS via a...
Medium 4.8
CVE-2020-25122
The Admin CP in vBulletin 5.6.3 allows XSS via a...
Medium 4.8
CVE-2020-25121
The Admin CP in vBulletin 5.6.3 allows XSS via the...
Medium 4.8

Affected Vendor

Affected Software

vbulletin
Vulnerable Versions:
5.0.1, 5.0.0

Timeline

Official Publish: December 14th, 2017
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.