CVE-2001-1471: High severity phpBB phpbb vulnerability
prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid language value, which prevents the variables (1) $lstatsblock in prefs.php or (2) $lprivnotify in auth.php from being properly initialized, which can be modified by the user and later used in an eval statement.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2001-1471?
CVE-2001-1471 has a high severity rating due to its ability to allow remote code execution.
How do I fix CVE-2001-1471?
To fix CVE-2001-1471, upgrade phpBB to version 1.4.1 or later to ensure that language value validation is properly implemented.
Who is affected by CVE-2001-1471?
CVE-2001-1471 affects all versions of phpBB up to and including version 1.4.0.
What exploits are associated with CVE-2001-1471?
Exploits associated with CVE-2001-1471 can lead to arbitrary PHP code execution by leveraging improperly initialized variables.
Is there a workaround for CVE-2001-1471?
A temporary workaround for CVE-2001-1471 includes restricting user access to the prefs.php script until the software is updated.