SB2017091916 - Open redirect in phpBB
Published: September 19, 2017 Updated: August 8, 2020
Security Bulletin ID
SB2017091916
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Open redirect (CVE-ID: CVE-2015-3880)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Remediation
Install update from vendor's website.
References
- http://www.openwall.com/lists/oss-security/2015/05/12/10
- http://www.securityfocus.com/bid/74592
- https://github.com/phpbb/phpbb/commit/1a3350619f428d9d69d196c52128727e27ef2f04
- https://wiki.phpbb.com/Release_Highlights/3.0.14
- https://wiki.phpbb.com/Release_Highlights/3.1.4
- https://www.phpbb.com/community/viewtopic.php?f=14&t=2313941