CVE-2019-16993

In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them.

CVSS v3 8.8 HIGH
CVSS v2.0 6.8 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/phpbb/phpbb/commit/18abef716ecf42a35416444f3f84f5459d573789	Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00036.html	Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/10/msg00006.html	Third Party Advisory
https://www.phpbb.com/community/viewtopic.php?t=2352606	Vendor Advisory
https://www.phpbb.com/support/documents.php?mode=changelog&version=3#v317	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:phpbb:phpbb:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-09-30 12:15

Updated : 2023-12-10 13:13

NVD link : CVE-2019-16993

Mitre link : CVE-2019-16993

CVE.ORG link : CVE-2019-16993

JSON object : View

Products Affected

phpbb

phpbb

debian

debian_linux

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2019-16993", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2019-09-30T12:15:10.860", "references": [{"url": "https://github.com/phpbb/phpbb/commit/18abef716ecf42a35416444f3f84f5459d573789", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://lists.debian.org/debian-lts-announce/2019/09/msg00036.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00006.html", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.phpbb.com/community/viewtopic.php?t=2352606", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.phpbb.com/support/documents.php?mode=changelog&version=3#v317", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them."}, {"lang": "es", "value": "En phpBB versiones anteriores a 3.1.7-PL1, el archivo includes/acp/acp_bbcodes.php presenta una comprobaci\u00f3n inapropiada de un token de CSRF en la p\u00e1gina BBCode en el Panel de Control de Administraci\u00f3n. Un ataque de tipo CSRF real es posible si un atacante tambi\u00e9n logra recuperar el id de sesi\u00f3n de un administrador reautenticado antes de que sea atacado."}], "lastModified": "2019-11-21T13:34:48.817", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:phpbb:phpbb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AA2974D-B61E-4490-A399-8B9B5898B49D", "versionEndIncluding": "3.1.7"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}