CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NCVE-2019-13376
Medium (6.5) in phpbb phpbb. EPSS 0.7% chance of exploitation in the next 30 days.
phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-79, CWE-352
- Published
- Modified
- Record from
- the NVD, synced
Affected
- phpbb:phpbb