An Undisclosed Critical Vulnerability Affect vBulletin Forums — Patch Now

Maintainers of the vBulletin project recently announced an
important patch update but didn’t reveal any information on the
underlying security vulnerability, identified as CVE-2020-12720^[1].

Written in PHP programming language, vBulletin is a widely used
Internet forum software that powers over 100,000 websites on the
Internet, including forums for some Fortune 500 and many other top
companies.

Considering that the popular forum software is also one of the
favorite targets for hackers, holding back details of the flaw
could, of course, help many websites apply patches before hackers
can exploit them to compromise sites, servers, and their user
databases.

However, just like previous times, researchers and hackers have
already started reverse-engineering the software patch to locate
and understand the vulnerability.

National Vulnerability Database (NVD) is also analyzing the flaw
and revealed that the critical flaw originated from an incorrect
access control issue that affects vBulletin before 5.5.6pl1, 5.6.0
before 5.6.0pl1, and 5.6.1 before 5.6.1pl1.

“If you are using a version of vBulletin 5 Connect prior to
5.5.2, it is imperative that you upgrade as soon as possible,”
vBulletin said.

Though there was no proof-of-concept code available at the time
of writing this news or information about the vulnerability being
exploited in the wild, expectedly, an exploit for the flaw wouldn’t
take much time to surface on the Internet.

Meanwhile, Charles Fol^[2], a security engineer at
Ambionics, confirmed that he discovered and responsibly reported
this vulnerability to the vBulletin team, and has plans to release
more information during the SSTIC conference that’s scheduled for
the next month.

Forum administrators are advised to download and install
respective patches for the following versions of their forum
software as soon as possible.

• 5.6.1 Patch Level 1
• 5.6.0 Patch Level 1
• 5.5.6 Patch Level 1