MEDIUM5.8

GHSA-4hx9-p925-qcv7

phpBB Server side request forgery (SSRF)

Quick fix

GHSA-4hx9-p925-qcv7 — phpbb/phpbb: upgrade to the fixed version with the command below.

composer require phpbb/phpbb:^3.2.6

Details

Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of the host through the remote avatar upload function.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/phpbb/phpbb

Introduced in: 0Fixed in: 3.2.6

Fixcomposer require phpbb/phpbb:^3.2.6

References

https://nvd.nist.gov/vuln/detail/CVE-2019-11767[ADVISORY]
https://github.com/phpbb/phpbb-app[PACKAGE]
https://www.phpbb.com/community/viewtopic.php?f=14&t=2509941[WEB]