Vulnerability Description
Interpretation conflict in phpBB 2.0.17, with remote avatars and avatar uploading enabled, allows remote authenticated users to inject arbitrary web script or HTML via an HTML file with a GIF or JPEG file extension, which causes the HTML to be executed by a victim who views the file in Internet Explorer, which renders malformed image types as HTML, enabling cross-site scripting (XSS) attacks. NOTE: it could be argued that this vulnerability is due to a design flaw in Internet Explorer (CVE-2005-3312) and the proper fix should be in that browser; if so, then this should not be treated as a vulnerability in phpBB.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Phpbb Group | Phpbb | 2.0.17 |
References
- http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0479.htmlExploit
- http://marc.info/?l=bugtraq&m=113017003617987&w=2
- http://secunia.com/advisories/17295/PatchVendor Advisory
- http://secunia.com/advisories/18098PatchVendor Advisory
- http://www.debian.org/security/2005/dsa-925PatchVendor Advisory
- http://www.securityfocus.com/bid/15170
- https://exchange.xforce.ibmcloud.com/vulnerabilities/22837
- http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0479.htmlExploit
- http://marc.info/?l=bugtraq&m=113017003617987&w=2
- http://secunia.com/advisories/17295/PatchVendor Advisory
- http://secunia.com/advisories/18098PatchVendor Advisory
- http://www.debian.org/security/2005/dsa-925PatchVendor Advisory
- http://www.securityfocus.com/bid/15170
- https://exchange.xforce.ibmcloud.com/vulnerabilities/22837
FAQ
What is CVE-2005-3310?
CVE-2005-3310 is a vulnerability with a CVSS score of 3.5 (LOW). Interpretation conflict in phpBB 2.0.17, with remote avatars and avatar uploading enabled, allows remote authenticated users to inject arbitrary web script or HTML via an HTML file with a GIF or JPEG ...
How severe is CVE-2005-3310?
CVE-2005-3310 has been rated LOW with a CVSS base score of 3.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2005-3310?
Check the references section above for vendor advisories and patch information. Affected products include: Phpbb Group Phpbb.