Lucene search

[email protected]CVE-2014-5102

HistoryJul 25, 2014 - 7:55 p.m.

CVE-2014-5102

2014-07-2519:55:00

CWE-89

[email protected]

web.nvd.nist.gov

cve-2014-5102

sql injection

vbulletin

remote attack

9.3 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

59.4%

JSON

SQL injection vulnerability in vBulletin 5.0.4 through 5.1.3 Alpha 5 allows remote attackers to execute arbitrary SQL commands via the criteria[startswith] parameter to ajax/render/memberlist_items.

CPENameOperatorVersion
vbulletin:vbulletinvbulletineq5.0.5
vbulletin:vbulletinvbulletineq5.1.2
vbulletin:vbulletinvbulletineq5.1.0
vbulletin:vbulletinvbulletineq5.1.1
vbulletin:vbulletinvbulletineq5.1.3
vbulletin:vbulletinvbulletineq5.0.4

CPE	Name	Operator	Version
vbulletin:vbulletin	vbulletin	eq	5.0.5
vbulletin:vbulletin	vbulletin	eq	5.1.2
vbulletin:vbulletin	vbulletin	eq	5.1.0
vbulletin:vbulletin	vbulletin	eq	5.1.1
vbulletin:vbulletin	vbulletin	eq	5.1.3
vbulletin:vbulletin	vbulletin	eq	5.0.4

References

packetstormsecurity.com/files/127537/vBulletin-5.1.2-SQL-Injection.html

www.pcworld.com/article/2455500/emergency-vbulletin-patch-fixes-dangerous-sql-injection-vulnerability.html

www.securityfocus.com/bid/68709

www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4097503-security-patch-release-for-vbulletin-5-0-4-5-0-5-5-1-0-5-1-1-and-5-1-2

9.3 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

59.4%

JSON

Related for CVE-2014-5102

prion1 cvelist1