PT-2023-32416 · Phpbb · Phpbb

Shin24 · Published 2023-11-02 · Updated 2024-05-17 · CVE-2023-5917

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions phpBB versions up to 3.3.10

Description A problematic issue has been found in phpBB, affecting the function main of the file phpBB/includes/acp/acp icons.php of the component Smiley Pack Handler. The manipulation of the argument pak leads to cross-site scripting. The attack may be initiated remotely. Upgrading to version 3.3.11 is able to address this issue.

Recommendations For phpBB versions up to 3.3.10, upgrade to version 3.3.11 to address the issue. As a temporary workaround, consider restricting access to the vulnerable component Smiley Pack Handler until the upgrade is applied. Avoid using the argument pak in the affected function main until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-PHPBB-2023-5917

CVE-2023-5917

GHSA-GMX8-8RFF-QV6Q

Affected Products

Phpbb

References · 17

• https://github.com/phpbb/phpbb/commit/ccf6e6c255d38692d72fcb613b113e6eaa240aac · Patch
• https://github.com/phpbb/phpbb/releases/tag/release-3.3.11 · Patch
• https://osv.dev/vulnerability/CVE-2023-5917 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gmx8-8rff-qv6q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5917 · Security Note
• https://osv.dev/vulnerability/BIT-phpbb-2023-5917 · Vendor Advisory
• https://github.com/phpbb/phpbb-app/commit/a3a84334f1c17ee57cc9af3d84996af8772736d3 · Note
• https://github.com/phpbb/phpbb-app · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5917 · Note
• https://vuldb.com/?id.244307 · Note
• https://vuldb.com/?ctiid.244307 · Note
• https://t.me/cibsecurity/73422 · Telegram Post
• https://phpbb.com/community/viewtopic.php?t=2646991 · Note
• https://twitter.com/CVEnew/status/1720031338164781424 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1720059914473648493 · Twitter Post