CVE-2015-1432

EUVD-2015-1567
The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 65%
Affected Products (NVD)
VendorProductVersion
phpbbphpbb
𝑥
≤ 3.0.12
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
phpbb3
artful
dne
bionic
dne
cosmic
dne
disco
dne
lucid
ignored
precise
ignored
trusty
Fixed 3.0.12-1ubuntu0.1~esm1
released
utopic
ignored
vivid
not-affected
wily
not-affected
xenial
not-affected
yakkety
dne
zesty
dne
Common Weakness Enumeration
References
http://seclists.org/oss-sec/2015/q1/373
http://www.securityfocus.com/bid/72399
https://exchange.xforce.ibmcloud.com/vulnerabilities/100671
https://github.com/phpbb/phpbb/commit/23069a13e203985ab124d1139e8de74b12778449
https://github.com/phpbb/phpbb/pull/3311
https://security.gentoo.org/glsa/201701-25
https://tracker.phpbb.com/browse/PHPBB3-13526
https://wiki.phpbb.com/Release_Highlights/3.0.13
http://seclists.org/oss-sec/2015/q1/373
http://www.securityfocus.com/bid/72399
https://exchange.xforce.ibmcloud.com/vulnerabilities/100671
https://github.com/phpbb/phpbb/commit/23069a13e203985ab124d1139e8de74b12778449
https://github.com/phpbb/phpbb/pull/3311
https://security.gentoo.org/glsa/201701-25
https://tracker.phpbb.com/browse/PHPBB3-13526
https://wiki.phpbb.com/Release_Highlights/3.0.13