CVE-2004-2403: CSRF
Cross-site request forgery (CSRF) vulnerability in YaBB 1 GOLD SP 1.3.2 allows remote attackers to perform unauthorized actions as the administrative user via a link or IMG tag to YaBB.pl that specifies the desired action, id, and moda parameters.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2004-2403?
CVE-2004-2403 is considered to be a medium severity vulnerability due to its potential for unauthorized administrative actions.
How do I fix CVE-2004-2403?
To fix CVE-2004-2403, it is essential to implement CSRF tokens in forms and validate requests to ensure they originate from legitimate users.
Which versions of YaBB are affected by CVE-2004-2403?
CVE-2004-2403 affects YaBB versions 1.40, 1.41, and all 1 Gold SP 1.x versions including 1.3.2.
What actions can attackers perform due to CVE-2004-2403?
Attackers exploiting CVE-2004-2403 can perform unauthorized actions such as making changes to the forum or user settings as the administrative user.
Is there a patch available for CVE-2004-2403?
There is no specific patch for CVE-2004-2403, but updating to fixed versions and applying best practices for CSRF protection can mitigate the risk.