Cloudflare’s protection against a new Remote Code Execution vulnerability (CVE-2019-16759) in vBulletin
Sep 29, 2019Alex Cruz Farmer, Arun Singh
Summary
This post details the deployment of a new rule (ruleId: 100166) within Cloudflare's Specials Rulesets to protect against CVE-2019-16759, a zero-day Remote Code Execution vulnerability in vBulletin. It explains the implications of RCE vulnerabilities, the CVSS score (9.8/10), and its relevance to OWASP Top 10 risk areas. The post also guides users on enabling Managed Rulesets and Cloudflare Specials in their firewall settings and provides information on applying the vBulletin patch directly for those not using managed rulesets.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack