CVE-2005-3415 Security feature bypass in n/a
Remote attackers can bypass global variable deregistration protections in phpBB by manipulating GPC and GLOBALS variables, potentially leading to security control evasion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2005-3415?
CVE-2005-3415 is a high-severity vulnerability in Phpbb Group Phpbb, published on 1 Nov 2005. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
phpBB 2.0.17 and earlier allows remote attackers to bypass protection mechanisms that deregister global variables by setting both a GET/POST/COOKIE (GPC) variable and a GLOBALS[] variable with the same name, which causes phpBB to unset the GLOBALS[] variable but not the GPC variable.
Which versions are affected by CVE-2005-3415?
It affects 1 product.
Products include Phpbb Group Phpbb.
How do I fix CVE-2005-3415?
Upgrade to a fixed version.
Is CVE-2005-3415 being exploited?
There is no known exploitation of CVE-2005-3415 in the wild and no public exploit code.
Other vulnerabilities in Phpbb Group Phpbb
Sources
Also known as GHSA-2vjg-mqpc-fcrj.