{"id":"CVE-2020-17496","kind":"vulnerability","aliases":["CVE-2020-17496"],"related":[],"title":"vBulletin vBulletin: vBulletin PHP Module Remote Code Execution Vulnerability","description":"The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This CVE ID resolves an incomplete patch for CVE-2019-16759.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Unauthenticated RCE in vBulletin 5.5.4 through 5.6.2: one POST to /ajax/render/widget_tabbedcontainer_tab_panel with subWidgets[0][template]=widget_php runs attacker PHP. It bypasses the earlier CVE-2019-16759 fix. A public PoC exists and exploitation is active (CISA KEV, Unit 42). vBulletin Cloud is not affected.","severity":"critical","cvss":9.8,"epss":0.87478,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"vBulletin vBulletin","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"vBulletin","fixed":["5.6.0 security patch","5.6.1 security patch","5.6.2 security patch"],"affected":">= 5.5.4, <= 5.6.2 (without Aug 2020 security patch)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","php","poc-public","self-hosted","vbulletin","vendor"],"not_affected_if":["managed-hosting","vbulletin-cloud"],"how_to_check":"Check your vBulletin version in the AdminCP or footer: 5.5.4 to 5.6.2 without the August 2020 security patch is vulnerable, and older 5.x should be treated as vulnerable too. Check whether the patch files are applied by asking vBulletin support or comparing against the patch zip from the Member's Area. Search web logs for POSTs to ajax/render/widget_tabbedcontainer_tab_panel containing widget_php or subWidgets. Treat any hit as a possible compromise and look for webshells.","fix":"Download and install the vendor security patch for your 5.6.x version (5.6.0, 5.6.1 or 5.6.2) from the Member's Area. Upload the zip's files over the existing ones. Older versions must be upgraded to 5.6.2 plus the patch. The vendor gives no separate patched version number. 5.6.3 Beta is unpatched and not for production.","status":"open","published_at":"2020-08-12T14:15:13+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T20:29:32+00:00","updated_at":"2026-10-23T20:55:38+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-10-23T20:29:32Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vBulletin patch per vendor instructions (CISA KEV required action); exact fixed version unknown from sources.\nUnknown whether the vendor advisory names the patched release.","summary":"vBulletin's PHP module has a remote code execution flaw triggered by crafted subWidgets data sent to the ajax/render/widget_tabbedcontainer_tab_panel endpoint. An unauthenticated attacker can run code on the server, and CISA lists it as actively exploited.","category":"vendor","who_cares":["vbulletin","php","self-hosted"],"confidence":0.7,"analyst_note":"Find the vBulletin vendor advisory and the exact patched version for CVE-2020-17496 (incomplete patch for CVE-2019-16759); check the NVD page linked in the sources for affected version ranges.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"severity_if_unknown":"critical"},"cost_usd":0.000384,"input_tokens":2148,"output_tokens":339,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vBulletin vendor advisory and the exact patched version for CVE-2020-17496 (incomplete patch for CVE-2019-16759); check the NVD page linked in the sources for affected version ranges.","search":"'-16759':55B,107C '-17496':12A,15A '-2019':54B,106C '-2020':11A,14A '/ajax/render/widget_tabbedcontainer_tab_panel':39B '0':42B '42':68B '5.5.4':33B '5.6.2':35B 'action':110C 'activ':64B 'affect':73B 'ajax/render/widget_tabbedcontainer_tab_panel':95C 'allow':84C 'appli':111C 'attack':47B 'bypass':50B 'cisa':65B,108C 'cloud':70B 'code':7A,87C 'contain':79C 'craft':90C 'cve':10A,13A,53B,98C,105C 'data':92C 'earlier':52B 'execut':8A,88C 'exist':60B 'exploit':19B,62B 'fix':56B 'host':26B 'id':99C 'incomplet':102C 'instruct':115C 'kev':66B 'modul':5A,76C 'one':36B 'patch':103C 'per':113C 'php':4A,20B,45B,48B,75C 'poc':22B,59B 'poc-publ':21B 'post':37B 'public':23B,58B 'rce':30B 'remot':6A,86C 'request':96C 'requir':109C 'resolv':100C 'run':46B 'self':25B 'self-host':24B 'subwidget':41B,91C 'templat':43B 'unauthent':29B 'unit':67B 'unspecifi':81C 'updat':112C 'vbulletin':1A,2A,3A,16A,17A,18A,27B,32B,69B,78C 'vendor':28B,114C 'via':89C 'vulner':9A,82C 'widget':44B 'within':77C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-08-12T14:15:13+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2020-17496","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-17496","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T17:39:59+00:00","note":null},{"source":"epss","external_id":"CVE-2020-17496","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-17496","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-17496","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-17496","severity":null,"published_at":"2020-08-12T14:15:13+00:00","modified_at":"2026-06-17T02:59:01+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2020-17496:32","url":null,"severity":null,"published_at":"2026-10-23T20:55:38+00:00","modified_at":"2026-10-23T20:55:38+00:00","first_seen_at":"2026-10-23T20:55:38+00:00","fetched_at":"2026-10-23T20:55:38+00:00","note":"Vendor advisory (Aug 10 2020) ships security patches for 5.6.0/5.6.1/5.6.2 only; no new version number. NVD range 5.5.4-5.6.2; public PoC (Zenofex, Full Disclosure); exploited in wild per Unit 42 and CISA KEV."}],"documents":[{"id":883,"url":"https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4445227-vbulletin-5-6-0-5-6-1-5-6-2-security-patch","title":"vBulletin 5.6.0, 5.6.1, 5.6.2 Security Patch","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":883,"url":"https://forum.vbulletin.com/forum/vbulletin-announcements/vbulletin-announcements_aa/4445227-vbulletin-5-6-0-5-6-1-5-6-2-security-patch","title":"vBulletin 5.6.0, 5.6.1, 5.6.2 Security Patch","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":884,"url":"https://seclists.org/fulldisclosure/2020/Aug/5","title":"Full Disclosure: RCE 0day in vBulletin 5.x (Zenofex)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":885,"url":"https://unit42.paloaltonetworks.com/cve-2020-17496/","title":"Unit 42: Exploits in the Wild for vBulletin CVE-2020-17496","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null},{"id":886,"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-17496","title":"NVD CVE-2020-17496","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}