CVE-2020-25123: 
VBulletin vulnerability analysis and mitigation

The Admin CP in vBulletin 5.6.3 allows Cross-Site Scripting (XSS) via a Smilie Title to Smilies Manager. This vulnerability was disclosed on September 3, 2020 and has been assigned CVE-2020-25123 (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 4.8 (MEDIUM) with the following vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The vulnerability requires high privileges and user interaction to exploit. It has been classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

The vulnerability allows attackers with administrative access to inject malicious web scripts or HTML via the Smilie Title field in the Smilies Manager section of the Admin Control Panel. This could potentially lead to client-side attacks against other administrators viewing the affected area (NVD).

The vulnerability requires high privileges (administrative access) to exploit, making it less severe than unauthenticated vulnerabilities. Additionally, successful exploitation requires user interaction, as another user must view the manipulated content (NVD).

Users should upgrade to a version newer than vBulletin 5.6.3 that contains fixes for this vulnerability. As this is a high-privilege vulnerability, ensuring proper access control and limiting administrative access to trusted users can help reduce the risk (NVD).