Description
Open redirect vulnerability in forum/login.php in vBulletin 4.1.3 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter in a lostpw action.
References (1)
Core 1
Core References
Various Sources x_refsource_confirm
http://www.vbulletin.com/forum/showthread.php/381014-Potential-Phishing-Vector?p=2166441
Scores
EPSS
0.0153
EPSS Percentile
71.9%
Details
CWE
CWE-20
Status
published
Products (13)
vbulletin/vbulletin
4.0.0
vbulletin/vbulletin
4.0.1
vbulletin/vbulletin
4.0.2
vbulletin/vbulletin
4.0.3
vbulletin/vbulletin
4.0.4
vbulletin/vbulletin
4.0.5
vbulletin/vbulletin
4.0.6
vbulletin/vbulletin
4.0.7
vbulletin/vbulletin
4.0.8
vbulletin/vbulletin
4.1
... and 3 more
Published
Dec 31, 2012
Tracked Since
Feb 18, 2026