PT-2019-13299 · Phpbb Limited · Phpbb

Publicado 2019-09-27 · Atualizado 2022-05-24 · CVE-2019-13376

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions phpBB version 3.2.7

Description The issue allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature, leading to stored XSS due to CSRF Token Hijacking.

Recommendations For phpBB version 3.2.7, update to a version that fixes the CSRF Token Hijacking issue in the Remote Avatar feature to prevent session id theft and stored XSS.

Exploit

Correção

CSRF

XSS

Enumeração de Fraquezas

CWE-352

CWE-79

Identificadores relacionados

CVE-2019-13376

DLA-1942-1

DLA-1942-2

GHSA-6MH2-98GR-WV76

Produtos afetados

Phpbb

Referências · 21

• 🔥 https://blog.phpbb.com/category/security · Exploit
• 🔥 https://ssd-disclosure.com/archives/4007/ssd-advisory-phpbb-csrf-token-hijacking-leading-to-stored-xss · Exploit
• https://github.com/phpbb/phpbb/commit/cdf4f5ef85f05c0f94eae1a9edb1c28d4ac3515f · Nota
• https://github.com/phpbb/phpbb-app · Nota
• https://t.me/cibsecurity/31675 · Publicação no Telegram
• https://cve.org/CVERecord?id=CVE-2019-13376 · Nota de Segurança
• https://security-tracker.debian.org/tracker/DLA-1942-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-13376 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-13376 · Aviso do Fabricante
• https://packages.debian.org/src:phpbb3 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13376 · Nota de Segurança
• https://osv.dev/vulnerability/DLA-1942-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DLA-1942-2 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/source-package/phpbb3 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13376 · Nota