PT-2019-13299 · Phpbb Limited · Phpbb

Published 2019-09-27 · Updated 2022-05-24 · CVE-2019-13376

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions phpBB version 3.2.7

Description The issue allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature, leading to stored XSS due to CSRF Token Hijacking.

Recommendations For phpBB version 3.2.7, update to a version that fixes the CSRF Token Hijacking issue in the Remote Avatar feature to prevent session id theft and stored XSS.

Exploit

Fix

CSRF

XSS

Weakness Enumeration

CWE-352

CWE-79

Related Identifiers

CVE-2019-13376

DLA-1942-1

DLA-1942-2

GHSA-6MH2-98GR-WV76

Affected Products

Phpbb

References · 21

• 🔥 https://blog.phpbb.com/category/security · Exploit
• 🔥 https://ssd-disclosure.com/archives/4007/ssd-advisory-phpbb-csrf-token-hijacking-leading-to-stored-xss · Exploit
• https://cve.org/CVERecord?id=CVE-2019-13376 · Security Note
• https://security-tracker.debian.org/tracker/DLA-1942-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13376 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-13376 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13376 · Security Note
• https://osv.dev/vulnerability/DLA-1942-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1942-2 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/phpbb3 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-13376 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6mh2-98gr-wv76 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16993 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13376 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13776 · Security Note