CVE-2019-13376: CSRF
Published Sep 27, 2019
·Updated
phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS
Affected Software
2 affected componentsFixes available
composer/phpbb/phpbb<=3.2.7
3.2.8
phpBB phpbb=3.2.7
Event History
Sep 27, 2019
CVE Published
via MITRE·12:08 PM
Data Sourced
via MITRE·12:08 PM
Description
May 24, 2022
Advisory Published
via GitHub·04:56 PM
Frequently Asked Questions
1
What is the vulnerability ID for this phpBB vulnerability?
The vulnerability ID for this phpBB vulnerability is CVE-2019-13376.
2
What is the severity of CVE-2019-13376?
The severity of CVE-2019-13376 is medium with a severity score of 6.5 out of 10.
3
How does CVE-2019-13376 allow the stealing of an Administration Control Panel session id?
CVE-2019-13376 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature.
4
What is CSRF Token Hijacking?
CSRF Token Hijacking is when an attacker uses a Cross-Site Request Forgery vulnerability to steal or manipulate a user's session token.
5
What is the impact of CVE-2019-13376?
The impact of CVE-2019-13376 is stored XSS (Cross-Site Scripting) which can lead to unauthorized access, data theft, and potential further exploitation.