CVE-2019-16531

2019-09-2002:16:13

Google

osv.dev

6.9 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

74.9%

LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php.

CPENameOperatorVersion
layerbbeq1.0.6
layerbbeq1.0.4
layerbbeq1.1.2
layerbbeq1.1.0
layerbbeq1.0.5
layerbbeq1.1.1
layerbbeq1.1.3

Name	Operator	Version
layerbb	eq	1.0.6
layerbb	eq	1.0.4
layerbb	eq	1.1.2
layerbb	eq	1.1.0
layerbb	eq	1.0.5
layerbb	eq	1.1.1
layerbb	eq	1.1.3

References

packetstormsecurity.com/files/154549/LayerBB-1.1.3-Cross-Site-Request-Forgery.html

github.com/0xB9/LayerBB-1.1.3-CSRF/blob/master/README.md

github.com/AndyRixon/LayerBB/compare/1.1.3...1.1.4

github.com/AndyRixon/LayerBB/pull/40