GitHub Advisoryadvisory · Packagist

GHSA-6mh2-98gr-wv76 phpBB Cross-Site Request Forgery (CSRF)

MEDIUM Published 2022-05-24 Modified 2024-04-24 Official page ↗

Aliases: CVE-2019-13376
Ecosystem: Packagist
Packages: phpbb/phpbb
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weaknesses: CWE-352, CWE-79
Reviewed: 2024-04-24

Affected packages

• Packagist phpbb/phpbb: < 3.2.8 → fixed in 3.2.8

Description

phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS

Alias · CVE (1)

CVE-2019-13376 phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. vulnerability

Weakness · CWE (2)

CWE-352 Cross-Site Request Forgery weakness
CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References

https://nvd.nist.gov/vuln/detail/CVE-2019-13376 advisory
https://blog.phpbb.com/category/security web
https://github.com/phpbb/phpbb-app package
https://ssd-disclosure.com/archives/4007/ssd-advisory-phpbb-csrf-token-hijacking-leading-to-stored-xss web