Medium severity · published Sep 19, 2017
CVE-2015-3419
vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations via vectors related to an input…
6.5
CVSS
1%
EPSS
No
On KEV
Description
vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations via vectors related to an input validation failure.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VB
Vbulletin · Vbulletin
5.0.0; 5.0.0; 5.0.1; 5.0.2; 5.0.3; 5.0.4; +17 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-3419
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-3419
Mailing List
http://www.openwall.com/lists/oss-security/2015/04/24/4
Vendor Advisory
http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/4319488-security-patch-released-for-vbulletin-5-1-4-5-1-6-and-vbulletin-cloud
More from Vbulletin
9.8
CVE-2020-17496
vBulletin PHP Module Remote Code Execution Vulnerability
9.8
CVE-2019-16759
vBulletin PHP Module Remote Code Execution Vulnerability
9.8
CVE-2026-61511
vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php
9.8
CVE-2025-48827
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated…
9.8
CVE-2023-25135
vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization