GHSA-3747-gjc9-vvg6

Source

https://github.com/advisories/GHSA-3747-gjc9-vvg6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-3747-gjc9-vvg6/GHSA-3747-gjc9-vvg6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-3747-gjc9-vvg6

Aliases

CVE-2013-6919

Published

2022-05-17T04:19:03Z

Modified

2023-11-08T03:57:27Z

Summary

phpThumb is vulnerable to Server-Side Request Forgery (SSRF)

Details

The default configuration of phpThumb before 1.7.12 has a false value for the disable_debug option, which allows remote attackers to conduct Server-Side Request Forgery (SSRF) attacks via the src parameter.

Database specific

{
    "cwe_ids":  [
        "CWE-918"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-08-29T18:13:58Z",
    "nvd_published_at":  "2014-12-27T18:59:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

Packagist / james-heinrich/phpthumb

Package

Name: james-heinrich/phpthumb
Purl: pkg:composer/james-heinrich/phpthumb

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.7.12

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-3747-gjc9-vvg6/GHSA-3747-gjc9-vvg6.json"