CVE-2019-16993
phpBB Cross-Site Request Forgery (CSRF)
In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them.
- Record
CVE-2019-16993- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them.
- Record
CVE-2019-16993- Updated
- 2026-11-02
EUVDEUVD-2022-5363 No score
In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them.
- Record
EUVD-2022-5363- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vj3x-vfm4-hvxc
phpBB Cross-Site Request Forgery (CSRF)
In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them.
- Record
GHSA-vj3x-vfm4-hvxc- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them.
- Record
CVE-2019-16993- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-vj3x-vfm4-hvxc
phpBB Cross-Site Request Forgery (CSRF)
In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them.
- Record
GHSA-vj3x-vfm4-hvxc- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-16993
In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting them.
- Record
UBUNTU-CVE-2019-16993- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpbb/phpbbPackagist |
before 3.1.7-PL1 | 3.1.7-PL1 |
phpbb3Debian:8 From an advisory covering 2 CVEs |
before 3.0.12-5+deb8u4, plus listed versions 3.0.12-53.0.12-5+deb8u13.0.12-5+deb8u23.0.12-5+deb8u3 |
3.0.12-5+deb8u4 |
phpbb/phpbbPackagist |
before 3.1.7-PL1, plus listed versions 3.0.123.0.12-RC13.0.12-RC23.0.12-RC33.0.13 Show 31 moreShow less3.0.13-PL13.0.13-RC13.0.143.0.14-RC13.1.03.1.0-RC13.1.0-RC23.1.0-RC33.1.0-RC43.1.0-RC53.1.0-RC63.1.0-a13.1.0-a23.1.0-a33.1.0-b13.1.0-b23.1.0-b33.1.0-b43.1.13.1.23.1.2-RC13.1.33.1.3-RC13.1.3-RC23.1.43.1.4-RC13.1.4-RC23.1.53.1.5-RC13.1.63.1.6-RC1 |
3.1.7-PL1 |
phpbb3Ubuntu:Pro:14.04:LTS |
before 3.0.12-1ubuntu0.1~esm1, plus listed versions 3.0.11-53.0.12-1 |
3.0.12-1ubuntu0.1~esm1 |
phpbb3Ubuntu:16.04:LTS |
All versions, plus listed versions 3.0.14-13.0.14-1ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-16993 is a high vulnerability (CVSS 8.8) in Phpbb, published September 30, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.80%, the 56th percentile. Fixed in phpbb/phpbb 3.1.7-PL1.
References
phpbb.com/community/viewtopic.php?t=2352606
github.com/phpbb/phpbb/commit/18abef716ecf42a35416444f3f84f5459d573789
lists.debian.org/debian-lts-announce/2019/09/msg00036.html
nvd.nist.gov/vuln/detail/CVE-2019-16993