CVE-2019-13376

phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature

published September 27, 2019

CVSS
—
EPSS
1%
Percentile
51.7
In the wild
Unconfirmed
What it is

phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00678 · 51.7th percentile
Published
2019-09-27T12:08Z
EPSS history
Timeline
  • 27 SEP 12:08Z
    phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature
    cvelistv5