[sv1cec]

Well, I do not know what was the big rush about the CSRF issue. According to Jelsoft people, when I protested that a patch should be issued for those still running vB 3.0.xx since this is a security issue :

Regarding the vulnerability of vBulletin 3.0.x and 3.5.x to the reported CSRF exploit, it is important to note that vBulletin 3 has had protection against the vast majority of CSRF attacks for quite some time, in the form of a referrer check to ensure that POST requests originate from the same domain as that on which vBulletin is installed. This fix was implemented in response to articles such as the one to which you refer on darkreading.com. This protection is sufficient to deflect almost all CSRF attempts. This most recent CSRF exploit is relatively minor in the scheme of software flaws; Secunia rates CSRF exploits' severity at only 2/5.

And this comes from James Limm, Jelsoft CEO:

In principle, I agree that we have an obligation to ensure that our products are free from significant security issues. Security is something that we take very seriously - issues such as XSS exploits are fixed extremely quickly for all currently supported versions (usually we release a patch within 24 hours).

In this particular case however, the relatively minor nature of the CSRF issue, coupled with the complex nature of the fix and the fact that version 3.0 is an extremely old version that has been superceded twice led us to make this decision.

Mind you, Jelsoft issued an End-of-Life statement for vB 3.0 the next day after I complained about the lack of fix for a security issue. Some customer care!!!