~ / search / GHSA-vj3x-vfm4-hvxc

GHSA-vj3x-vfm4-hvxc

phpBB Cross-Site Request Forgery (CSRF)

Source: GitHub Advisory Database (reviewed) High CVE-2019-16993

Packages

EcosystemPackageAffectedFixed in
Packagist phpbb/phpbb < 3.1.7-PL1 3.1.7-PL1

Details

As written in the advisory (Markdown source, shown as plain text).

In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them.

References

External links from the advisory. They lead to third-party sites.