Server Side Request Forgery Vulnerability in phpBB3: CVE-2019-11767
Summary
UBUNTU-CVE-2019-11767: Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of the host through the remote avatar upload function. Affects phpbb3 versions 3.0.11-5 – 3.0.12-1ubuntu0.1~esm1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpBB3 is a widely used open-source forum software that allows users to create and manage online discussion boards. It provides features such as user management, customizable themes, and extensive plugin support. However, versions prior to 3.2.6 are vulnerable to a server-side request forgery (SSRF) issue, which can lead to unauthorized access to local network resources.
Vulnerability Detail
The vulnerability, identified as CVE-2019-11767, allows attackers to exploit the remote avatar upload function in phpBB3 to check for the existence of files and services on the local network of the host. This could lead to sensitive information disclosure and potential further exploitation of the local network. The issue originates from improper validation of user input, allowing crafted requests to be sent to internal resources.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As an immediate workaround, it is advisable to disable the remote avatar upload functionality until the software can be updated. This can be done by navigating to the phpBB3 administration panel and disabling the option for remote avatars.
Conclusion
CVE-2019-11767 poses a significant risk to users of phpBB3 versions prior to 3.2.6 due to its server-side request forgery capabilities. It is crucial to update to the latest version to ensure the security of your application and protect against potential exploitation.
See every vulnerability recorded for phpbb3 →
FAQ
CVE-2019-11767 is a vulnerability in phpBB3 that allows server-side request forgery, enabling attackers to probe local network resources.
Versions of phpBB3 prior to 3.2.6 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive information and potential exploitation of internal network services.
Yes, you can disable the remote avatar upload feature as a temporary measure to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for phpbb3.
