HIGH8.8
GHSA-vj3x-vfm4-hvxc
phpBB Cross-Site Request Forgery (CSRF)
Quick fix
GHSA-vj3x-vfm4-hvxc — phpbb/phpbb: upgrade to the fixed version with the command below.
composer require phpbb/phpbb:^3.1.7-PL1Details
In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-16993[ADVISORY]
- https://github.com/phpbb/phpbb/commit/18abef716ecf42a35416444f3f84f5459d573789[WEB]
- https://github.com/phpbb/phpbb-app[PACKAGE]
- https://lists.debian.org/debian-lts-announce/2019/09/msg00036.html[WEB]
- https://lists.debian.org/debian-lts-announce/2019/10/msg00006.html[WEB]
- https://www.phpbb.com/community/viewtopic.php?t=2352606[WEB]
- https://www.phpbb.com/support/documents.php?mode=changelog&version=3#v317[WEB]