~ / search / GHSA-wg24-9xm9-593v

GHSA-wg24-9xm9-593v

phpBB Cross-Site Request Forgery (CSRF)

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-16107

Packages

EcosystemPackageAffectedFixed in
Packagist phpbb/phpbb >= 3.2.7, < 3.2.8 3.2.8

Details

As written in the advisory (Markdown source, shown as plain text).

Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments.

References

External links from the advisory. They lead to third-party sites.