CVE-2023-5917: phpBB Smiley Pack acp_icons.php main cross site scripting
First published: Thu Nov 02 2023(Updated: )
A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10. This issue affects the function main of the file `phpBB/includes/acp/acp_icons.php` of the component Smiley Pack Handler. The manipulation of the argument pack leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 3.3.11 is able to address this issue. The patch is named ccf6e6c255d38692d72fcb613b113e6eaa240aac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-244307.
Credit: cna@vuldb.com cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/phpbb/phpbb | <3.3.11 | 3.3.11 |
| Phpbb Phpbb | <3.3.11 | |
| <3.3.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/phpbb/phpbb/commit/ccf6e6c255d38692d72fcb613b113e6eaa240aac
- https://github.com/phpbb/phpbb/releases/tag/release-3.3.11
- https://vuldb.com/?ctiid.244307
- https://vuldb.com/?id.244307
- https://www.phpbb.com/
- https://www.phpbb.com/community/viewtopic.php?t=2646991
- https://nvd.nist.gov/vuln/detail/CVE-2023-5917
- https://www.phpbb.com
- https://github.com/phpbb/phpbb-app/commit/a3a84334f1c17ee57cc9af3d84996af8772736d3
- https://github.com/advisories/GHSA-gmx8-8rff-qv6q (Advisory)
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-5917.
What is the severity of CVE-2023-5917?
The severity of CVE-2023-5917 is medium.
Which software versions are affected by CVE-2023-5917?
The vulnerability affects phpBB up to version 3.3.10.
What is the CWE of CVE-2023-5917?
The CWE of CVE-2023-5917 is CWE-79.
How can I fix CVE-2023-5917?
To fix CVE-2023-5917, update phpBB to version 3.3.11 or higher.
- agent/type
- agent/first-publish-date
- agent/severity
- agent/remedy
- agent/title
- agent/weakness
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-gmx8-8rff-qv6q
- alias/CVE-2023-5917
- agent/software-canonical-lookup
- agent/description
- agent/references
- collector/nvd-cve
- source/NVD
- agent/author
- collector/github-advisory
- agent/tags
- collector/nvd-api
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- agent/trending
- package-manager/composer
- vendor/phpbb
- canonical/phpbb phpbb