CVE-2015-1432: CSRF
Published Feb 10, 2015
·Updated
The messageoptions function in includes/ucp/ucppmoptions.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors.
Affected Software
1 affected component
phpBB phpbb<=3.0.12
Event History
Feb 10, 2015
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-1432?
CVE-2015-1432 is considered a medium severity vulnerability due to its potential for CSRF attacks.
2
How do I fix CVE-2015-1432?
To fix CVE-2015-1432, upgrade phpBB to version 3.0.13 or later.
3
What type of attack does CVE-2015-1432 enable?
CVE-2015-1432 enables remote attackers to conduct Cross-Site Request Forgery (CSRF) attacks.
4
What versions of phpBB are affected by CVE-2015-1432?
CVE-2015-1432 affects phpBB versions prior to 3.0.13, specifically up to 3.0.12.
5
Where in the phpBB code base does CVE-2015-1432 occur?
CVE-2015-1432 occurs in the message_options function located in includes/ucp/ucp_pm_options.php.