Description

phpBB 2.0.23 includes the session ID in a request to modcp.php when the moderator or administrator closes a thread, which allows remote attackers to hijack the session via a post in the thread containing a URL to a remotely hosted image, which might include the session ID in the Referer header.

Remediation

References

CVE-2008-7143

Related Vulnerabilities

Apache HTTP Server Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2021-41773)

Grafana Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2021-27962)

Oracle Database Server CVE-2012-1746 Vulnerability (CVE-2012-1746)

Artifactory CVE-2023-42508 Vulnerability (CVE-2023-42508)

Ampache Improper Link Resolution Before File Access ('Link Following') Vulnerability (CVE-2008-3929)

Severity

Medium

Classification

CVE-2008-7143 CWE-200

Tags

Missing Update Known Vulnerabilities