phpBB Cross-Site Request Forgery (CSRF)
Date: 2022-05
Affected: composer/phpbb/phpbb
Attack vector: info-disclosure
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2008-6507
CVE-2020-5501
CWE: CWE-200
CWE-352
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

phpBB 3.2.8 allows a CSRF attack that can modify a group avatar.


Mitigations:

Architectural layers (MAESTRO):