CVE-2017-1000419

{"id": "CVE-2017-1000419", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2018-01-02T19:29:00.207", "references": [{"url": "https://www.phpbb.com/community/viewtopic.php?f=14&p=14782136", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.sec-consult.com/en/blog/advisories/phpbb-server-side-request-forgery-vulnerability/index.html", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting internal content and potentially attacking such internal services via the web application."}, {"lang": "es", "value": "phpBB, en su versi\u00f3n 3.2.0, es vulnerable a SSRF en la funci\u00f3n Remote Avatar. Esto permite que un atacante realice un escaneo de puertos, solicitando contenido interno y atacando potencialmente tales servicios internos a trav\u00e9s de la aplicaci\u00f3n web."}], "lastModified": "2018-01-16T18:12:46.490", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:phpbb:phpbb:3.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E4ADB41-770D-41ED-A347-3EF025A9DFCC"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}