CVE-2023-5917: phpBB Smiley Pack XSS Vulnerability in acp_icons.php
Summary
CVE-2023-5917: phpBB's Smiley Pack acp_icons.php main pack vulnerable to cross site scripting. Affects phpbb/phpbb versions < 3.3.11. Fixed in 3.3.11. How to fix ↓
Also tracked for
- phpbb · Bitnami
The same CVE-2023-5917 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpBB is a widely used open-source forum software that enables users to create and manage online discussion boards. It is known for its extensibility, allowing users to add various features through plugins and extensions. The Smiley Pack is a component of phpBB that manages emoticons used in posts. However, versions up to 3.3.10 of phpBB are vulnerable to a cross-site scripting (XSS) attack due to improper handling of user input in the Smiley Pack Handler.
Vulnerability Detail
The vulnerability arises from the function 'main' in the file phpBB/includes/acp/acp_icons.php, where the argument 'pack' can be manipulated by an attacker. This manipulation can lead to cross-site scripting, allowing attackers to execute arbitrary scripts in the context of the user's browser. The attack can be initiated remotely, posing a significant risk to users who interact with the affected component. The vulnerability is classified under CWE-79, which pertains to improper neutralization of input during web page generation.
How To Fix
Minimum fixed version
3.3.11
This is the first release that contains the fix.
composer require phpbb/phpbb:3.3.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Smiley Pack Handler for untrusted users or disable the feature until the upgrade is completed. However, this is not a permanent solution and upgrading is strongly advised.
Conclusion
The CVE-2023-5917 vulnerability in phpBB's Smiley Pack poses a significant risk due to its potential for cross-site scripting attacks. Users are strongly encouraged to upgrade to version 3.3.11 or later to mitigate this risk. Temporary workarounds can be employed, but they do not replace the need for a proper update.
See every vulnerability recorded for phpbb/phpbb →
FAQ
CVE-2023-5917 is a cross-site scripting vulnerability found in the phpBB Smiley Pack component, affecting versions up to 3.3.10.
If exploited, this vulnerability can allow attackers to execute malicious scripts in the browsers of users visiting your forum, potentially compromising user data.
Yes, upgrading to phpBB version 3.3.11 or later addresses this vulnerability.
You can restrict access to the Smiley Pack Handler or disable it temporarily until you can perform the upgrade.
You can use Vulert, which monitors open-source vulnerabilities in your software using the composer.lock file. You can check your application for vulnerabilities without signup at the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpbb/phpbb.
