Description

The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors.

Remediation

References

CVE-2015-1432

Related Vulnerabilities

Oracle HTTP Server Other Vulnerability (CVE-2004-2115)

WordPress Plugin JC Coupon Cross-Site Scripting (2.5)

WordPress Plugin Google AdSense Click-Fraud Monitoring Cross-Site Scripting (1.8.6)

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2010-1617)

WordPress 2.5 Cross-Site Scripting Vulnerability (2.5)

Severity

Medium

Classification

CVE-2015-1432 CWE-352

Tags

Missing Update Known Vulnerabilities