未評価
phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token...
CVE-2019-13376
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- report blog.phpbb.com
- report ssd-disclosure.com