p PatchFirst

CVE-2019-11767

CVE-2019-11767

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of the host through the remote avatar upload function.

CVSS 5.8 · Medium · EPSS 1.2% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • phpbb/phpbb Packagist

    Versions
    • 3.0.12
    • 3.0.12-RC1
    • 3.0.12-RC2
    • 3.0.12-RC3
    • 3.0.13
    • 3.0.13-PL1
    • 3.0.13-RC1
    • 3.0.14
    • 3.0.14-RC1
    • 3.1.0
    • 3.1.0-RC1
    • 3.1.0-RC2
    • 3.1.0-RC3
    • 3.1.0-RC4
    • 3.1.0-RC5
    • 3.1.0-RC6
    • 3.1.0-a1
    • 3.1.0-a2
    • 3.1.0-a3
    • 3.1.0-b1
    • 3.1.0-b2
    • 3.1.0-b3
    • 3.1.0-b4
    • 3.1.1
    • 3.1.10
    • 3.1.10-RC1
    • 3.1.11
    • 3.1.11-RC1
    • 3.1.12
    • 3.1.2
    • 3.1.2-RC1
    • 3.1.3
    • 3.1.3-RC1
    • 3.1.3-RC2
    • 3.1.4
    • 3.1.4-RC1
    • 3.1.4-RC2
    • 3.1.5
    • 3.1.5-RC1
    • 3.1.6
    • 3.1.6-RC1
    • 3.1.7
    • 3.1.7-RC1
    • 3.1.7-pl1
    • 3.1.8
    • 3.1.8-RC1
    • 3.1.9
    • 3.1.9-RC1
    • 3.2.0
    • 3.2.0-RC1
    • 3.2.0-RC2
    • 3.2.0-a1
    • 3.2.0-b2
    • 3.2.1
    • 3.2.1-RC1
    • 3.2.2
    • 3.2.2-RC1
    • 3.2.3
    • 3.2.3-RC1
    • 3.2.3-RC2
    • 3.2.4
    • 3.2.4-RC1
    • 3.2.5
    • 3.2.5-RC1
    • 3.2.6-RC1
    Affected ranges
    • ECOSYSTEM: < 3.2.6

    Update to 3.2.6

  • phpbb3 Ubuntu:Pro:14.04:LTS

    Versions
    • 3.0.11-5
    • 3.0.12-1
    • 3.0.12-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • phpbb3 Ubuntu:16.04:LTS

    Versions
    • 3.0.14-1
    • 3.0.14-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →