Vulnerability Name:

CVE-2015-3880 (CCN-103153)

Assigned:2015-05-12
Published:2015-05-12
Updated:2017-09-27
Summary:Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS v3 Severity:6.1 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:5.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N)
4.3 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-601
Vulnerability Consequences:Informational
References:Source: MITRE
Type: CNA
CVE-2015-3880

Source: CCN
Type: oss-security Mailing List, Tue, 12 May 2015 10:55:59 +0200
CVE Request: phpbb open redirect

Source: CCN
Type: oss-security Mailing List, Tue, 12 May 2015 14:54:25 -0400 (EDT)
Re: CVE Request: phpbb open redirect

Source: MLIST
Type: Mailing List, Patch, Third Party Advisory
[oss-security] 20150512 Re: CVE Request: phpbb open redirect

Source: BID
Type: Third Party Advisory, VDB Entry
74592

Source: CCN
Type: BID-74592
phpBB 'functions.php' Open Redirection Vulnerability

Source: XF
Type: UNKNOWN
phpbb-cve20153880-open-redirect(103153)

Source: CONFIRM
Type: Patch, Third Party Advisory
https://github.com/phpbb/phpbb/commit/1a3350619f428d9d69d196c52128727e27ef2f04

Source: CCN
Type: phpBB Wiki Web site
Release Highlights/3.0.14

Source: CONFIRM
Type: Third Party Advisory
https://wiki.phpbb.com/Release_Highlights/3.0.14

Source: CONFIRM
Type: Third Party Advisory
https://wiki.phpbb.com/Release_Highlights/3.1.4

Source: CCN
Type: phpBB Web site
phpBB 3.0.14 and 3.1.4 Release - Please Update

Source: CONFIRM
Type: Vendor Advisory
https://www.phpbb.com/community/viewtopic.php?f=14&t=2313941

Vulnerable Configuration:Configuration 1:
  • cpe:/a:phpbb:phpbb:*:rc1:*:*:*:*:*:* (Version <= 3.0.14)
  • OR cpe:/a:phpbb:phpbb:3.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:phpbb:phpbb:3.1.0:a1:*:*:*:*:*:*
  • OR cpe:/a:phpbb:phpbb:3.1.0:a2:*:*:*:*:*:*
  • OR cpe:/a:phpbb:phpbb:3.1.0:a3:*:*:*:*:*:*
  • OR cpe:/a:phpbb:phpbb:3.1.0:b1:*:*:*:*:*:*
  • OR cpe:/a:phpbb:phpbb:3.1.0:b2:*:*:*:*:*:*
  • OR cpe:/a:phpbb:phpbb:3.1.0:b3:*:*:*:*:*:*
  • OR cpe:/a:phpbb:phpbb:3.1.0:b4:*:*:*:*:*:*
  • OR cpe:/a:phpbb:phpbb:3.1.0:rc1:*:*:*:*:*:*
  • OR cpe:/a:phpbb:phpbb:3.1.0:rc2:*:*:*:*:*:*
  • OR cpe:/a:phpbb:phpbb:3.1.0:rc3:*:*:*:*:*:*
  • OR cpe:/a:phpbb:phpbb:3.1.0:rc4:*:*:*:*:*:*
  • OR cpe:/a:phpbb:phpbb:3.1.0:rc5:*:*:*:*:*:*
  • OR cpe:/a:phpbb:phpbb:3.1.0:rc6:*:*:*:*:*:*
  • OR cpe:/a:phpbb:phpbb:3.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:phpbb:phpbb:3.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:phpbb:phpbb:3.1.2:rc1:*:*:*:*:*:*
  • OR cpe:/a:phpbb:phpbb:3.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:phpbb:phpbb:3.1.3:rc1:*:*:*:*:*:*
  • OR cpe:/a:phpbb:phpbb:3.1.3:rc2:*:*:*:*:*:*
  • OR cpe:/a:phpbb:phpbb:3.1.4:rc1:*:*:*:*:*:*
  • OR cpe:/a:phpbb:phpbb:3.1.4:rc2:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:phpbb:phpbb:3.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:phpbb:phpbb:3.0.12:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:com.ubuntu.trusty:def:20153880000
    V
    		CVE-2015-3880 on Ubuntu 14.04 LTS (trusty) - medium.
    2017-09-19
    oval:com.ubuntu.xenial:def:20153880000
    V
    		CVE-2015-3880 on Ubuntu 16.04 LTS (xenial) - medium.
    2017-09-19
    oval:com.ubuntu.xenial:def:201538800000000
    V
    		CVE-2015-3880 on Ubuntu 16.04 LTS (xenial) - medium.
    2017-09-19
    oval:com.ubuntu.precise:def:20153880000
    V
    		CVE-2015-3880 on Ubuntu 12.04 LTS (precise) - medium.
    2015-05-13
    BACK
    phpbb phpbb * rc1
    phpbb phpbb 3.1.0
    phpbb phpbb 3.1.0 a1
    phpbb phpbb 3.1.0 a2
    phpbb phpbb 3.1.0 a3
    phpbb phpbb 3.1.0 b1
    phpbb phpbb 3.1.0 b2
    phpbb phpbb 3.1.0 b3
    phpbb phpbb 3.1.0 b4
    phpbb phpbb 3.1.0 rc1
    phpbb phpbb 3.1.0 rc2
    phpbb phpbb 3.1.0 rc3
    phpbb phpbb 3.1.0 rc4
    phpbb phpbb 3.1.0 rc5
    phpbb phpbb 3.1.0 rc6
    phpbb phpbb 3.1.1
    phpbb phpbb 3.1.2
    phpbb phpbb 3.1.2 rc1
    phpbb phpbb 3.1.3
    phpbb phpbb 3.1.3 rc1
    phpbb phpbb 3.1.3 rc2
    phpbb phpbb 3.1.4 rc1
    phpbb phpbb 3.1.4 rc2
    phpbb phpbb 3.0.7
    phpbb phpbb 3.0.12