CVE-2015-3880: phpBB Open Redirect
Summary
CVE-2015-3880: phpBB Open Redirect. Affects phpbb/phpbb across 2 version ranges.
< 3.0.14
>= 3.1.0, < 3.1.4
Fixed in 3.0.14 or 3.1.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
phpBB is an open-source forum software written in PHP. It provides a platform for users to create and manage online discussion forums. The vulnerability identified as CVE-2015-3880 affects versions of phpBB prior to 3.0.14 and 3.1.x prior to 3.1.4. This vulnerability allows remote attackers to redirect users of Google Chrome to arbitrary websites and conduct phishing attacks.
Vulnerability Detail
The open redirect vulnerability in phpBB allows attackers to manipulate the redirection behavior of the software, leading users to unintended and potentially malicious websites. This can be exploited through unspecified vectors, enabling phishing attacks that can deceive users into revealing sensitive information or performing unintended actions. The vulnerability specifically targets users of Google Chrome, making them more susceptible to the attack.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.0.143.0.14composer require phpbb/phpbb:3.0.14 -
>= 3.1.0, < 3.1.43.1.4composer require phpbb/phpbb:3.1.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched versions of phpBB.
Conclusion
The open redirect vulnerability in phpBB can be exploited by attackers to redirect users of Google Chrome to malicious websites, potentially leading to phishing attacks. To mitigate this vulnerability, it is crucial to upgrade to the recommended patched versions of phpBB. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpbb/phpbb →
FAQ
phpBB is an open-source forum software written in PHP that allows users to create and manage online discussion forums.
An open redirect vulnerability allows attackers to manipulate the redirection behavior of a software, leading users to unintended and potentially malicious websites.
This vulnerability affects users of phpBB versions prior to 3.0.14 and 3.1.x prior to 3.1.4. Attackers can redirect users of Google Chrome to arbitrary websites, potentially leading to phishing attacks.
To fix this vulnerability, it is recommended to upgrade to phpBB version 3.0.14 or later for phpBB 3.0.x installations, and version 3.1.4 or later for phpBB 3.1.x installations.
There is no specific workaround provided. It is crucial to apply the recommended fix by upgrading to the patched versions of phpBB.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpbb/phpbb.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
