GHSA-6mh2-98gr-wv76

phpBB Cross-Site Request Forgery (CSRF)

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-13376

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	phpbb/phpbb	< 3.2.8	3.2.8

Details

As written in the advisory (Markdown source, shown as plain text).

phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-13376 advisory
https://blog.phpbb.com/category/security web
https://github.com/phpbb/phpbb-app package
https://ssd-disclosure.com/archives/4007/ssd-advisory-phpbb-csrf-token-hijacking-leading-to-stored-xss web