CVE-2023-5917 : A vulnerability, which was classified as problematic, has been found in phpBB up

A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10. This issue affects the function main of the file phpBB/includes/acp/acp_icons.php of the component Smiley Pack Handler. The manipulation of the argument pak leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 3.3.11 is able to address this issue. The patch is named ccf6e6c255d38692d72fcb613b113e6eaa240aac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-244307.

Published 2023-11-02 11:15:15

Updated 2024-05-17 02:33:24

Source VulDB

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2023-5917

Phpbb » Phpbb
Versions before (<) 3.3.11
cpe:2.3:a:phpbb:phpbb:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-5917

EPSS FAQ

0.16%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 54 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-5917

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.3	LOW	AV:N/AC:L/Au:M/C:N/I:P/A:N	6.4	2.9	VulDB
Access Vector: Network Access Complexity: Low Authentication: Multiple Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
2.4	LOW	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N	0.9	1.4	VulDB
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: Low Availability: None
2.4	LOW	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N	0.9	1.4	VulDB
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: Low Availability: None
6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2023-5917

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: cna@vuldb.com (Primary)

References for CVE-2023-5917

https://github.com/phpbb/phpbb/releases/tag/release-3.3.11

Release release-3.3.11 · phpbb/phpbb · GitHub
Release Notes
https://www.phpbb.com/community/viewtopic.php?t=2646991

phpBB • phpBB 3.3.11 Release
Release Notes
https://vuldb.com/?ctiid.244307

CVE-2023-5917: phpBB Smiley Pack acp_icons.php main cross site scripting
Permissions Required;VDB Entry
https://www.phpbb.com/

phpBB • Free and Open Source Forum Software
Product
https://github.com/phpbb/phpbb/commit/ccf6e6c255d38692d72fcb613b113e6eaa240aac

Merge pull request #69 from phpbb/ticket/security-279 · phpbb/phpbb@ccf6e6c · GitHub
Patch
https://vuldb.com/?id.244307

CVE-2023-5917: phpBB Smiley Pack acp_icons.php main cross site scripting
Third Party Advisory;VDB Entry

Jump to

Vulnerability Details : CVE-2023-5917

Products affected by CVE-2023-5917

Exploit prediction scoring system (EPSS) score for CVE-2023-5917

CVSS scores for CVE-2023-5917

CWE ids for CVE-2023-5917

References for CVE-2023-5917