Server-Side Request Forgery Vulnerability in phpBB by phpBB Group
CVE-2020-8226

5.8MEDIUM

Key Information:

Vendor

PHPbb

Status
Https://github.com/PHPbb/PHPbb
Vendor
CVE Published:
17 August 2020

What is CVE-2020-8226?

A Server-Side Request Forgery (SSRF) vulnerability exists in phpBB versions earlier than 3.2.10 and 3.3.1. This vulnerability can be exploited through the improper validation of image dimensions during remote image checks, allowing an attacker to send crafted requests to internal services or third-party servers, potentially compromising sensitive data or services within the context of the server.

Affected Version(s)

https://github.com/phpbb/phpbb 3.2.10 and 3.3.1

References

https://www.phpbb.com/community/viewtopic.php?f=14&t=2562631
x_refsource_MISC
https://www.phpbb.com/community/viewtopic.php?f=14&t=2562636
x_refsource_MISC

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.