CVE-2023-5917 json
phpBB Smiley Pack acp_icons.php main cross site scripting
published 2023-11-02 3 y ago modified 2026-06-17 4 mo ago also BIT-phpbb-2023-5917 , EUVD-2023-2966 , GHSA-gmx8-8rff-qv6q
- cvss
- 2.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 50%
- public exploits
- 0
- none known
Summary
A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10. This issue affects the function main of the file phpBB/includes/acp/acp_icons.php of the component Smiley Pack Handler. The manipulation of the argument pak leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 3.3.11 is able to address this issue. The patch is named ccf6e6c255d38692d72fcb613b113e6eaa240aac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-244307.
Patch / fix
- packagist phpbb/phpbb 3.3.11
- bitnami phpbb 3.3.11
- phpbb phpbb 3.3.11
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 20 mo ago
Exploit prediction
0.62% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 2.4 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N |
| CNA | 3.0 | 2.4 | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N |
| CNA | 2.0 | 3.3 | AV:N/AC:L/Au:M/C:N/I:P/A:N |
| GitHub | 3.0 | 2.4 | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| OSV | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | phpbb/phpbb | <3.3.11 |
3.3.11 |
| bitnami | phpbb | <3.3.11 |
3.3.11 |
Affected products
- n/a phpBB
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/phpbb/phpbb/commit/ccf6e6c255d38692d72fcb613b113e6eaa240aac
patch, web
-
github.com
/phpbb/phpbb/releases/tag/release-3.3.11
patch, web, release-notes
-
github.com
/phpbb/phpbb-app/commit/a3a84334f1c17ee57cc9af3d84996af8772736d3
web
-
vuldb.com
/?id.244307
vdb-entry, technical-description, web, third-party-advisory
-
vuldb.com
/?ctiid.244307
signature, permissions-required, web, vdb-entry
-
phpbb.com
/community/viewtopic.php?t=2646991
related, web, release-notes
-
phpbb.com
/
product, web
-
nvd.nist.gov
/vuln/detail/CVE-2023-5917
advisory
-
github.com
/phpbb/phpbb-app
package
-
phpbb.com
web
Sources
- CVE List CVE-2023-5917
- GitHub Advisory GHSA-gmx8-8rff-qv6q
- NVD CVE-2023-5917
- OSV BIT-phpbb-2023-5917
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.