NVD

Id
23753  
Name
CVE-2015-1432  
Description
The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-02-10  
Modified Date
2015-02-11  
Seq
2015-1432  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
126291 23753 CVE-2015-1432 [oss-security] 20150131 Re: CVE request: phpbb3 CSRF and CSS injection  View
126292 23753 CVE-2015-1432 72399  View
126293 23753 CVE-2015-1432 phpbb3-cve20151432-csrf(100671)  View
126294 23753 CVE-2015-1432 https://github.com/phpbb/phpbb/commit/23069a13e203985ab124d1139e8de74b12778449  View
126295 23753 CVE-2015-1432 https://github.com/phpbb/phpbb/pull/3311  View
126296 23753 CVE-2015-1432 https://tracker.phpbb.com/browse/PHPBB3-13526  View
126297 23753 CVE-2015-1432 https://wiki.phpbb.com/Release_Highlights/3.0.13  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
6151 JVNDB-2015-001471 phpBB の includes/ucp/ucp_pm_options.php の message_options 関数における CSRF 攻撃を実行される脆弱性 phpBB の includes/ucp/ucp_pm_options.php の message_options 関数は、form キーを適切に検証しないため、CSRF 攻撃を実行されるおよびフルフォルダの設定を変更される脆弱性が存在します。 CVE-2015-1432 78657 CVE-2015-1432 23753 6.8 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-001471.html 2015-01-20 2015-02-17 View