CVE-2008-0471: CSRF
Published Jan 29, 2008
·Updated
Cross-site request forgery (CSRF) vulnerability in privmsg.php in phpBB 2.0.22 allows remote attackers to delete private messages (PM) as arbitrary users via a deleteall action.
Affected Software
1 affected component
phpBB phpbb=2.0.22
Event History
Jan 29, 2008
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-0471?
CVE-2008-0471 is considered a medium severity Cross-site Request Forgery vulnerability.
2
How do I fix CVE-2008-0471?
To fix CVE-2008-0471, upgrade phpBB to version 2.0.23 or later to eliminate the CSRF vulnerability.
3
What types of attacks are possible with CVE-2008-0471?
CVE-2008-0471 allows remote attackers to delete private messages as any user through CSRF attacks.
4
Is CVE-2008-0471 present in other versions of phpBB?
CVE-2008-0471 specifically affects phpBB version 2.0.22, and other versions should be evaluated separately.
5
How can users mitigate risks associated with CVE-2008-0471?
Users can mitigate risks from CVE-2008-0471 by implementing protections against CSRF attacks, such as anti-CSRF tokens.