CVE-2019-16993

Опубликовано: 30 сент. 2019

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them.

Ссылки

https://github.com/phpbb/phpbb/commit/18abef716ecf42a35416444f3f84f5459d573789
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00036.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/10/msg00006.html
Third Party Advisory
https://www.phpbb.com/community/viewtopic.php?t=2352606
Vendor Advisory
https://www.phpbb.com/support/documents.php?mode=changelog&version=3#v317
Vendor Advisory
https://github.com/phpbb/phpbb/commit/18abef716ecf42a35416444f3f84f5459d573789
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00036.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/10/msg00006.html
Third Party Advisory
https://www.phpbb.com/community/viewtopic.php?t=2352606
Vendor Advisory
https://www.phpbb.com/support/documents.php?mode=changelog&version=3#v317
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:phpbb:phpbb:*:*:*:*:*:*:*:*

Версия до 3.1.7 (включая)

Конфигурация 2

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

EPSS

Процентиль: 45%

0.00222

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

CVE-2019-16993

CVSS3: 8.8

ubuntu

больше 6 лет назад

CVE-2019-16993

CVSS3: 8.8

debian

больше 6 лет назад

In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper v ...

GHSA-vj3x-vfm4-hvxc

CVSS3: 8.8

github

больше 3 лет назад

phpBB Cross-Site Request Forgery (CSRF)

EPSS

Процентиль: 45%

0.00222

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352