CVE-2006-4272 Denial of service in n/a

High 7.5 Published 21 Aug 2006 Updated 7 Aug 2024

Remote attackers can cause denial of service by flooding the registration page with requests, mitigated by enabling CAPTCHA or server-level rate limiting.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2006-4272?

CVE-2006-4272 is a high-severity denial of service vulnerability in Jelsoft Vbulletin, published on 21 Aug 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Jelsoft vBulletin 3.5.4 allows remote attackers to register multiple arbitrary users and cause a denial of service (resource consumption) via a large number of requests to register.php. NOTE: the vendor has disputed this vulnerability, stating "If you have the CAPTCHA enabled then the registrations wont even go through. ... if you are talking about the flood being allowed in the first place then surely this is something that should be handled at the server level.

Which versions are affected by CVE-2006-4272?

It affects 1 product.

Products include Jelsoft Vbulletin.

How do I fix CVE-2006-4272?

No fix has been published for CVE-2006-4272 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2006-4272 being exploited?

There is no known exploitation of CVE-2006-4272 in the wild and no public exploit code.

All Jelsoft Vbulletin vulnerabilities

Sources

Also known as GHSA-pxwq-5hrx-rxf2.