GHSA-9jm4-rg99-566c

ghsaUSosv

phpBB Server-Side Request Forgery (SSRF)

view advisory published 2022-05-14Licence: CC-BY-4.0

phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting internal content and potentially attacking such internal services via the web application.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-1000419US	high7.5	1.32% (71st)	—	2018-01-02
phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting internal content and potentially attacki…

references

External citations — patches, advisories, analysis.

https://github.com/phpbb/phpbb-appPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2017-1000419ADVISORY
https://www.phpbb.com/community/viewtopic.php?f=14&p=14782136WEB
https://www.sec-consult.com/en/blog/advisories/phpbb-server-side-request-forgery-vulnerability/index.htmlWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan