PT-2019-14689 · Layerbb · Layerbb

0Xb9 · Publicado 2019-09-20 · Atualizado 2019-09-20 · CVE-2019-16531

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LayerBB versions prior to 1.1.4

Description The issue allows for multiple CSRF problems, which can be demonstrated by modifying the System Settings through the "admin/general.php" endpoint, specifically by exploiting the lack of proper CSRF protection.

Recommendations For versions prior to 1.1.4, update to version 1.1.4 or later to resolve the issue. As a temporary workaround, consider implementing additional CSRF protection measures for the "admin/general.php" endpoint until the update can be applied.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2019-16531

Produtos afetados

Layerbb

Referências · 7

• 🔥 https://exploit-db.com/exploits/47403 · Exploit
• 🔥 https://github.com/0xB9/LayerBB-1.1.3-CSRF/blob/master/README.md · Exploit
• https://github.com/AndyRixon/LayerBB/pull/40 · Correção
• https://github.com/AndyRixon/LayerBB/compare/1.1.3...1.1.4 · Correção
• https://osv.dev/vulnerability/CVE-2019-16531 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-16531 · Nota de Segurança
• http://packetstormsecurity.com/files/154549/LayerBB-1.1.3-Cross-Site-Request-Forgery.html · Nota