phpBB arbitrary CSS injection · CVE-2019-16108 · GitHub Advisory Database · GitHub

phpBB arbitrary CSS injection

High severity GitHub Reviewed Published May 24, 2022 to the GitHub Advisory Database • Updated Apr 24, 2024

Package

phpbb/phpbb (Composer)

Affected versions

= 3.2.7

Patched versions

3.2.8

Description

phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode.

References

Published by the National Vulnerability Database

Mar 20, 2020

Published to the GitHub Advisory Database May 24, 2022

Reviewed Apr 24, 2024

Last updated Apr 24, 2024

Severity

High

7.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N