PT-2020-9789

CVE-2019-16107

·

Published

2020-03-11

·

Updated

2022-05-24

Description by

CVSS 3.1
4.3
Medium
MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions phpBB version 3.2.7
Description The issue is related to missing form token validation, which allows Cross-Site Request Forgery (CSRF) attacks. Specifically, this affects the deletion of post attachments.
Recommendations For phpBB version 3.2.7, update to a version that includes the fix for the missing form token validation to prevent CSRF attacks in deleting post attachments.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-352: Cross-Site Request Forgery (CSRF)
Related identifiers
CVE-2019-16107
GHSA-WG24-9XM9-593V
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com