Description

The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors.

Remediation

References

CVE-2015-1432

Related Vulnerabilities

MySQL CVE-2023-22058 Vulnerability (CVE-2023-22058)

Atlassian Jira Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-11587)

EspoCRM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-14329)

WordPress Plugin Simple Sticky Footer Cross-Site Request Forgery (1.3.2)

Liferay DXP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-37940)

Severity

Medium

Classification

CVE-2015-1432 CWE-352

Tags

Missing Update Known Vulnerabilities