CVE-2020-8226 — Externally Controlled Reference to a Resource in Another Sphere in Phpbb

CWE-610 — Externally Controlled Reference to a Resource in Another SphereCWE-918 — Server-Side Request Forgery5 documents4 sources
Severity
5.8MEDIUMNVD
EPSS
0.2%
top 60.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
PhpbbHttps Github.com Phpbb Phpbb
Timeline
PublishedAug 17
Latest updateMay 24

Description

A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image dimensions check to be used to SSRF.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶NVDphpbb/phpbb3.3.0 — 3.3.1+1
▶Packagistphpbb/phpbb3.2.0 — 3.2.10+1
▶CVEListV5https/github.com_phpbb_phpbb3.2.10 and 3.3.1

Patches

Patch: www.phpbb.com ↗Patch: www.phpbb.com ↗Patch: www.phpbb.com ↗

🔴Vulnerability Details

3
OSV
phpBB Server-Side Request Forgery Vulnerability↗2022-05-24
▶
GHSA
phpBB Server-Side Request Forgery Vulnerability↗2022-05-24
▶
OSV
CVE-2020-8226: A vulnerability exists in phpBB <v3↗2020-08-17
▶

🕵️Threat Intelligence

1
Wiz
CVE-2019-25685 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶