{"id":"CVE-2015-3880","aliases":["EUVD-2022-4231","GHSA-hwq7-cvp8-6hm3","UBUNTU-CVE-2015-3880"],"status":"published","title":"phpBB Open Redirect","description":"Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02048,"percentile":0.81336,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2017-09-19T15:00:00Z","modified":"2026-06-17T00:26:25Z","fixes":[{"ecosystem":"Packagist","package":"phpbb/phpbb","fixed_in":["3.0.14","3.1.4"],"sources":["ghsa","osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"phpbb3","fixed_in":["3.0.12-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"phpbb/phpbb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.14"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"phpbb/phpbb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.4"}]}]},{"source":"osv","ecosystem":"Packagist","package":"phpbb/phpbb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.14"}]}],"versions":["3.0.12","3.0.12-RC1","3.0.12-RC2","3.0.12-RC3","3.0.13","3.0.13-PL1","3.0.13-RC1","3.0.14-RC1"]},{"source":"osv","ecosystem":"Packagist","package":"phpbb/phpbb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.4"}]}],"versions":["3.1.0","3.1.1","3.1.2","3.1.2-RC1","3.1.3","3.1.3-RC1","3.1.3-RC2","3.1.4-RC1","3.1.4-RC2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"phpbb3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-1ubuntu0.1~esm1"}]}],"versions":["3.0.11-5","3.0.12-1"]}],"products":[{"vendor":"phpbb","product":"phpbb"}],"references":[{"url":"https://wiki.phpbb.com/Release_Highlights/3.1.4","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"https://github.com/phpbb/phpbb/commit/1a3350619f428d9d69d196c52128727e27ef2f04","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2015/05/12/10","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","web"]},{"url":"https://www.phpbb.com/community/viewtopic.php?f=14\u0026t=2313941","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://www.securityfocus.com/bid/74592","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://wiki.phpbb.com/Release_Highlights/3.0.14","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3880","tags":["advisory"]},{"url":"https://github.com/phpbb/phpbb/commit/c1702b8e19a69c98ef049abb4e14157e3e208ed4","tags":["web"]},{"url":"https://web.archive.org/web/20170520103544/http://www.securityfocus.com/bid/74592","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hwq7-cvp8-6hm3"},{"url":"https://github.com/phpbb/phpbb","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2015-3880","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/05/12/2","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3880","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-3880","description":"Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors.","status":"published","published":"2017-09-19T15:00:00Z","modified":"2024-08-06T05:56:16.326Z","updated_at":"2026-11-02T14:35:42.331636Z"}],"euvd":[{"id":"EUVD-2022-4231","description":"Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors.","status":"published","published":"2017-09-19T15:00:00Z","modified":"2024-08-06T05:56:16Z","updated_at":"2026-11-03T02:22:06.212182Z"}],"ghsa":[{"id":"GHSA-hwq7-cvp8-6hm3","title":"phpBB Open Redirect","description":"Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors.","status":"published","published":"2022-05-17T00:47:44Z","modified":"2023-08-03T21:30:12Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:36:59.456342Z"}],"nvd":[{"id":"CVE-2015-3880","description":"Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors.","status":"published","published":"2017-09-19T15:29:00.867Z","modified":"2026-06-17T00:26:25.22Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:03:19.244941Z"}],"osv":[{"id":"GHSA-hwq7-cvp8-6hm3","title":"phpBB Open Redirect","description":"Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors.","status":"published","published":"2022-05-17T00:47:44Z","modified":"2024-02-16T08:22:26.065982Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:49.621585Z"},{"id":"UBUNTU-CVE-2015-3880","description":"Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors.","status":"published","published":"2017-09-19T15:29:00Z","modified":"2025-07-18T16:43:13Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:10.045446Z"}]}}