CVE-2005-3310 Cross-site scripting in n/a

Low 3.5 Published 25 Oct 2005 Updated 7 Aug 2024

Authenticated users can inject HTML via disguised image files, leading to XSS when viewed in Internet Explorer.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2005-3310?

CVE-2005-3310 is a low-severity cross-site scripting vulnerability in Phpbb Group Phpbb, published on 25 Oct 2005. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Interpretation conflict in phpBB 2.0.17, with remote avatars and avatar uploading enabled, allows remote authenticated users to inject arbitrary web script or HTML via an HTML file with a GIF or JPEG file extension, which causes the HTML to be executed by a victim who views the file in Internet Explorer, which renders malformed image types as HTML, enabling cross-site scripting (XSS) attacks. NOTE: it could be argued that this vulnerability is due to a design flaw in Internet Explorer (CVE-2005-3312) and the proper fix should be in that browser; if so, then this should not be treated as a vulnerability in phpBB.

Which versions are affected by CVE-2005-3310?

It affects 1 product.

Products include Phpbb Group Phpbb.

How do I fix CVE-2005-3310?

Apply the vendor's patch.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2005-3310 being exploited?

There is no known exploitation of CVE-2005-3310 in the wild and no public exploit code.

All Phpbb Group Phpbb vulnerabilities

Sources

Also known as GHSA-94qp-2fqg-7mc4.