CVE-2020-5502: phpBB 3.2.8 CSRF Attack on Pending Group Memberships
Summary
CVE-2020-5502: phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships. Affects phpbb versions >= 3.2.8, <= 3.2.8. No fix is published. How to fix ↓
Also tracked for
- phpbb/phpbb · Packagist
The same CVE-2020-5502 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
phpBB is an open-source forum software package that allows users to create and manage online communities. It provides various features such as user registration, discussion boards, and moderation tools. The vulnerability affects version 3.2.8 of phpBB.
Vulnerability Detail
The vulnerability in phpBB 3.2.8 allows for a Cross-Site Request Forgery (CSRF) attack that can approve pending group memberships. An attacker can trick an authenticated user with administrative privileges into performing unintended actions, such as approving group membership requests without their knowledge or consent. This can lead to unauthorized access and potential abuse of the forum's functionalities.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability at this time.
Conclusion
phpBB version 3.2.8 is vulnerable to a CSRF attack that can approve pending group memberships without user consent. To mitigate this vulnerability, it is crucial to update phpBB to the latest version that includes a fix for this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpbb →
FAQ
phpBB is an open-source forum software package used for creating and managing online communities.
A CSRF attack, or Cross-Site Request Forgery attack, is a type of security exploit where an attacker tricks an authenticated user into performing unintended actions on a web application.
This vulnerability can lead to unauthorized access and abuse of the forum's functionalities, as an attacker can approve pending group memberships without the user's knowledge or consent.
Yes, the phpBB development team has released a fix for this vulnerability in a subsequent version. Users should update their phpBB installation to the latest version available.
There are no known workarounds for this vulnerability at this time.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpbb.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
