CVEvulnerability
CVE-2015-1432
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-02-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors.
Affected configurations
• phpbb phpbb (<= 3.0.12)
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- http://seclists.org/oss-sec/2015/q1/373 seclists.org
- http://www.securityfocus.com/bid/72399 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/100671 exchange.xforce.ibmcloud.com
- https://github.com/phpbb/phpbb/commit/23069a13e203985ab124d1139e8de74b12778449 github.com
- https://github.com/phpbb/phpbb/pull/3311 github.com
- https://security.gentoo.org/glsa/201701-25 security.gentoo.org
- https://tracker.phpbb.com/browse/PHPBB3-13526 tracker.phpbb.com
- https://wiki.phpbb.com/Release_Highlights/3.0.13 wiki.phpbb.com
- http://seclists.org/oss-sec/2015/q1/373 seclists.org
- http://www.securityfocus.com/bid/72399 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/100671 exchange.xforce.ibmcloud.com
- https://github.com/phpbb/phpbb/commit/23069a13e203985ab124d1139e8de74b12778449 github.com
- https://github.com/phpbb/phpbb/pull/3311 github.com
- https://security.gentoo.org/glsa/201701-25 security.gentoo.org
- https://tracker.phpbb.com/browse/PHPBB3-13526 tracker.phpbb.com
- https://wiki.phpbb.com/Release_Highlights/3.0.13 wiki.phpbb.com