CVE-2019-13376: CSRF
First published: Fri Sep 27 2019(Updated: )
phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Phpbb Phpbb | =3.2.7 | |
| composer/phpbb/phpbb | <=3.2.7 | 3.2.8 |
| =3.2.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this phpBB vulnerability?
The vulnerability ID for this phpBB vulnerability is CVE-2019-13376.
What is the severity of CVE-2019-13376?
The severity of CVE-2019-13376 is medium with a severity score of 6.5 out of 10.
How does CVE-2019-13376 allow the stealing of an Administration Control Panel session id?
CVE-2019-13376 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature.
What is CSRF Token Hijacking?
CSRF Token Hijacking is when an attacker uses a Cross-Site Request Forgery vulnerability to steal or manipulate a user's session token.
What is the impact of CVE-2019-13376?
The impact of CVE-2019-13376 is stored XSS (Cross-Site Scripting) which can lead to unauthorized access, data theft, and potential further exploitation.
- collector/nvd-index
- agent/weakness
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-6mh2-98gr-wv76
- alias/CVE-2019-13376
- agent/software-canonical-lookup
- agent/severity
- agent/references
- agent/description
- agent/author
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/tags
- agent/event
- agent/trending
- vendor/phpbb
- canonical/phpbb phpbb
- version/phpbb phpbb/3.2.7
- package-manager/composer