A zero-day remote code execution vulnerability in vBulletin, an extremely popular internet forum software used on more than 100,000 websites, was discovered and exposed this week.

An unknown, anonymous hacker posted news of the vulnerability, which affects versions 5.0.0 to the current 5.5.4 of the widely-used software. Dubbed CVE-2019-16759, the vulnerability does not require authentication, allowing attackers to perform command injection and remote code execution on the hacked system.

This dangerous vulnerability is currently in the wild and can possibly cause major damage to vBulletin users and their websites, but luckily patches for vBulletin versions 5.5.2, 5.5.3 and 5.5.4 have been released.

If you are using one of these software versions or your website, we highly recommend patching against the vulnerability. If you are using version 5.0.0 to 5.5.1, there is no patch currently available. We recommend updating to one of the current versions, and then patching for CVE-2019-16759.

 

Ready to try ThreatSTOP in your network? Want an expert-led demo to see how it works?

Get a Demo