github - ghsa-pxwq-5hrx-rxf2

GHSA-PXWQ-5HRX-RXF2

Vulnerability from github – Published: 2022-05-01 07:17 – Updated: 2022-05-01 07:17

Details

** DISPUTED ** Jelsoft vBulletin 3.5.4 allows remote attackers to register multiple arbitrary users and cause a denial of service (resource consumption) via a large number of requests to register.php. NOTE: the vendor has disputed this vulnerability, stating "If you have the CAPTCHA enabled then the registrations wont even go through. ... if you are talking about the flood being allowed in the first place then surely this is something that should be handled at the server level."

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2006-4272"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2006-08-21T21:04:00Z",
    "severity": "HIGH"
  },
  "details": "** DISPUTED **  Jelsoft vBulletin 3.5.4 allows remote attackers to register multiple arbitrary users and cause a denial of service (resource consumption) via a large number of requests to register.php.  NOTE: the vendor has disputed this vulnerability, stating \"If you have the CAPTCHA enabled then the registrations wont even go through. ...  if you are talking about the flood being allowed in the first place then surely this is something that should be handled at the server level.\"",
  "id": "GHSA-pxwq-5hrx-rxf2",
  "modified": "2022-05-01T07:17:04Z",
  "published": "2022-05-01T07:17:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-4272"
    },
    {
      "type": "WEB",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2006-08/0381.html"
    },
    {
      "type": "WEB",
      "url": "http://securityreason.com/securityalert/1426"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/443648/100/0/threaded"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2006-4272 (GCVE-0-2006-4272)

Vulnerability from cvelistv5 – Published: 2006-08-21 21:00 – Updated: 2024-08-07 19:06 Disputed

Summary

Jelsoft vBulletin 3.5.4 allows remote attackers to register multiple arbitrary users and cause a denial of service (resource consumption) via a large number of requests to register.php. NOTE: the vendor has disputed this vulnerability, stating "If you have the CAPTCHA enabled then the registrations wont even go through. ... if you are talking about the flood being allowed in the first place then surely this is something that should be handled at the server level.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	http://archives.neohapsis.com/archives/bugtraq/20…	mailing-listx_refsource_BUGTRAQ
	http://www.securityfocus.com/archive/1/443648/100…	mailing-listx_refsource_BUGTRAQ
	http://securityreason.com/securityalert/1426	third-party-advisoryx_refsource_SREASON

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T19:06:06.898Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20060818 Re: UPDATE vBulletin Version 3.5.4 exploit",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/bugtraq/2006-08/0381.html"
          },
          {
            "name": "20060815 UPDATE vBulletin Version 3.5.4 exploit",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/443648/100/0/threaded"
          },
          {
            "name": "1426",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/1426"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-08-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Jelsoft vBulletin 3.5.4 allows remote attackers to register multiple arbitrary users and cause a denial of service (resource consumption) via a large number of requests to register.php.  NOTE: the vendor has disputed this vulnerability, stating \"If you have the CAPTCHA enabled then the registrations wont even go through. ...  if you are talking about the flood being allowed in the first place then surely this is something that should be handled at the server level."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-17T20:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20060818 Re: UPDATE vBulletin Version 3.5.4 exploit",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://archives.neohapsis.com/archives/bugtraq/2006-08/0381.html"
        },
        {
          "name": "20060815 UPDATE vBulletin Version 3.5.4 exploit",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/443648/100/0/threaded"
        },
        {
          "name": "1426",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/1426"
        }
      ],
      "tags": [
        "disputed"
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-4272",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "** DISPUTED **  Jelsoft vBulletin 3.5.4 allows remote attackers to register multiple arbitrary users and cause a denial of service (resource consumption) via a large number of requests to register.php.  NOTE: the vendor has disputed this vulnerability, stating \"If you have the CAPTCHA enabled then the registrations wont even go through. ...  if you are talking about the flood being allowed in the first place then surely this is something that should be handled at the server level.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20060818 Re: UPDATE vBulletin Version 3.5.4 exploit",
              "refsource": "BUGTRAQ",
              "url": "http://archives.neohapsis.com/archives/bugtraq/2006-08/0381.html"
            },
            {
              "name": "20060815 UPDATE vBulletin Version 3.5.4 exploit",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/443648/100/0/threaded"
            },
            {
              "name": "1426",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/1426"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-4272",
    "datePublished": "2006-08-21T21:00:00",
    "dateReserved": "2006-08-21T00:00:00",
    "dateUpdated": "2024-08-07T19:06:06.898Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-PXWQ-5HRX-RXF2

CVE-2006-4272 (GCVE-0-2006-4272)

Tags

Sightings

Nomenclature