vBulletin 3.7.4 PL1 Released

vBulletin 3.7.4 PL1

An XSS flaw within the user control panel has recently been discovered. This could allow an attacker to carry out an action as a user or obtain access to a user's account. To resolve this issue, it is necessary to release a patch level version of vBulletin 3.7.4.

vBulletin 3.6 is not affected. vBulletin 3.8 is affected, and the next beta/release candidate will include the fix.

The upgrade process is the same as previous patch level releases - simply download the patch from the Members Area, extract the files and upload to your webserver, overwriting the existing files. There is no upgrade script required.

As with all security-based releases, we recommend that all customers upgrade as soon as possible in order to prevent any potential damage resulting from the flaw being exploited.


Upgrading from 3.7.4

If you are already running 3.7.4, the process you will be required to follow to make your board immune to this flaw is very simple.

There is no need to run an upgrade script if you are already running 3.7.4.

Visit the Patches section of the vBulletin Members' Area and download the patch for 3.7.4, then extract the files from the archive you downloaded, then upload the files to your board via FTP etc., overwriting the existing files. This will update your version to the PL1 release.


Upgrading from Versions Earlier than 3.7.4

If you are not already running 3.7.4, you should download the latest version from the Members' Area and perform an upgrade as normal.

Full instructions for upgrading vBulletin are available here.


Download vBulletin 3.7.4 PL1

As usual, the version released today is available for all customers with valid, active licenses to download from the vBulletin Members' Area.

vBulletin Members Area


More...

Has anyone performed the upgrade and verified that it plays nice with the current version of vbseo?

As it is a security upgrade you should worry about it .

I did it,thanks

Yes I'm a newbie.
First upgrage of VB from 3.7.3 to 3.7.4 PL1
Have VBSEO on the 3.7.3 and I have a question before I start.

Do I have to grab the old vBSEOconfig.php from the old includes file or is there a step to do that later?

Seems that the answer would be to just copy that file to the new package during the upload. 1st time so being extra cautious.

@David: Heres what I do to upgrade vB :

- Upload the new vBulletin files via FTP overwriting the old ones.
- Perform the upgrade (/install/upgrade.php)

This way, the files belonging to any mods aren't touched. And they will function without any problem. (I then update the installed modifications, one by one, if needed, to be compatible with the new vBulletin version).

I just uploaded the patch

I went from 3.7.3 to this update, all went smooth.

I have a feeling when I upgrade to this 3.8 gold will be out :(

upgrading only takes minutes unless you have really gone overboard on customizations in your skin or you have purchased a skin that is really heavily modified it wont take long at all. Even on my purchased skin which is a bit modified, it is really easy to tell what needs updating and only takes a minute or two longer.

Originally Posted by hornstar6969

unless you have really gone overboard on customizations in your skin

Exactly what I have...

over-paranoid IMO.

xss isn't going to get you hacked... only stupid users will fall for it and it won't effect your site, only their machine basically...
OR, they enter their login information in an xss iframe of some sort...
so, just tell your staff to be careful about how they log in and you have nothing to worry about IMO.

I won't b upgrading.

we have serious performance problems after upgrading to 3.7.4 PL1

anyone else noticed something in this direction? maybe it's another problem..

I have not noticed an increase my self.

I just updated from 3.7.1 to this update