CVE-2006-4450: Medium severity Phpbb Group Phpbb vulnerability
Published Aug 30, 2006
·Updated
usercpavatar.php in PHPBB 2.0.20, when avatar uploading is enabled, allows remote attackers to use the server as a web proxy by submitting a URL to the avatarurl parameter, which is then used in an HTTP GET request.
Affected Software
1 affected component
Phpbb Group Phpbb=2.0.20
Remediation
Patch Available
Event History
Aug 30, 2006
CVE Published
01:04 AM
CVE Published
via MITRE·05:00 AM
Data Sourced
via MITRE·05:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-4450?
CVE-2006-4450 is considered a moderate severity vulnerability due to its potential to allow remote code execution via a web proxy.
2
How do I fix CVE-2006-4450?
To mitigate CVE-2006-4450, it is recommended to disable avatar uploading or upgrade to a patched version of PHPBB beyond 2.0.20.
3
What software versions are affected by CVE-2006-4450?
CVE-2006-4450 specifically affects PHPBB version 2.0.20.
4
What types of attacks can exploit CVE-2006-4450?
CVE-2006-4450 can be exploited by attackers to perform cross-site scripting or use the server as a web proxy.
5
Is user input a risk factor in CVE-2006-4450?
Yes, the vulnerability arises from improper validation of user input in the avatarurl parameter.