PT-2019-14689 · Layerbb · Layerbb

0Xb9 · Published 2019-09-20 · Updated 2019-09-20 · CVE-2019-16531

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LayerBB versions prior to 1.1.4

Description The issue allows for multiple CSRF problems, which can be demonstrated by modifying the System Settings through the "admin/general.php" endpoint, specifically by exploiting the lack of proper CSRF protection.

Recommendations For versions prior to 1.1.4, update to version 1.1.4 or later to resolve the issue. As a temporary workaround, consider implementing additional CSRF protection measures for the "admin/general.php" endpoint until the update can be applied.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-16531

Affected Products

Layerbb

References · 7

• 🔥 https://exploit-db.com/exploits/47403 · Exploit
• 🔥 https://github.com/0xB9/LayerBB-1.1.3-CSRF/blob/master/README.md · Exploit
• https://github.com/AndyRixon/LayerBB/pull/40 · Patch
• https://github.com/AndyRixon/LayerBB/compare/1.1.3...1.1.4 · Patch
• https://osv.dev/vulnerability/CVE-2019-16531 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16531 · Security Note
• http://packetstormsecurity.com/files/154549/LayerBB-1.1.3-Cross-Site-Request-Forgery.html · Note