PT-2008-2104 · Woltlab · Woltlab Burning Board

Nbbn · Published 2008-01-29 · Updated 2018-10-15 · CVE-2008-0472

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Woltlab Burning Board (wBB) version 2.3.6 PL2

Description A cross-site request forgery (CSRF) issue exists, allowing remote attackers to perform actions such as deleting threads, potentially impersonating moderators or administrators.

Recommendations For version 2.3.6 PL2, consider implementing validation for requests to prevent unauthorized actions, such as verifying the origin of the request to prevent CSRF attacks. As a temporary workaround, restrict access to the modcp.php file, specifically the thread del action, to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2008-0472

Affected Products

Woltlab Burning Board

References · 6

• http://secunia.com/advisories/28634 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0472 · Security Note
• http://securityreason.com/securityalert/3586 · Note
• http://securityfocus.com/archive/1/486884/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0472 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39878 · Note