GitHub Advisoryadvisory · Packagist

GHSA-9jm4-rg99-566c phpBB Server-Side Request Forgery (SSRF)

HIGH Published 2022-05-14 Modified 2024-04-24 Official page ↗
Aliases
CVE-2017-1000419
Ecosystem
Packagist
Packages
phpbb/phpbb
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-918
Reviewed
2024-04-24

Affected packages

• Packagist phpbb/phpbb: >= 3.2.0, < 3.2.1 → fixed in 3.2.1

Description

phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting internal content and potentially attacking such internal services via the web application.

Related

Alias · CVE (1)

  • CVE-2017-1000419 phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References