GitHub Advisoryadvisory · Packagist

GHSA-4hx9-p925-qcv7 phpBB Server side request forgery (SSRF)

MEDIUM Published 2022-05-24 Modified 2024-04-24 Official page ↗
Aliases
CVE-2019-11767
Ecosystem
Packagist
Packages
phpbb/phpbb
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Weaknesses
CWE-918
Reviewed
2024-04-24

Affected packages

• Packagist phpbb/phpbb: < 3.2.6 → fixed in 3.2.6

Description

Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of the host through the remote avatar upload function.

Related

Alias · CVE (1)

  • CVE-2019-11767 Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References