Tóm tắt nhanh
- CVE-2017-6086 là lỗ hổng mức CAO (CVSS 8.8) ảnh hưởng opensolutions/vimbadmin, vimbadmin (vimbadmin).
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 2.0%, cao hơn 80.8% các lỗ hổng khác.
- Chưa có phiên bản vá trong dữ liệu: theo dõi khuyến cáo của nhà cung cấp ở phần Tham khảo.
Mô tả
Multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators to
- add an administrator user via a crafted POST request to
<vimbadmin directory>/application/controllers/DomainController.php,
- remove an administrator user via a crafted GET request to
<vimbadmin directory>/application/controllers/DomainController.php,
- change an administrator password via a crafted POST request to
<vimbadmin directory>/application/controllers/DomainController.php,
- add a mailbox via a crafted POST request to
<vimbadmin directory>/application/controllers/MailboxController.php,
- delete a mailbox via a crafted POST request to
<vimbadmin directory>/application/controllers/MailboxController.php,
- archive a mailbox address via a crafted GET request to
<vimbadmin directory>/application/controllers/ArchiveController.php,
- add an alias address via a crafted POST request to
<vimbadmin directory>/application/controllers/AliasController.php, or
- remove an alias address via a crafted GET request to
<vimbadmin directory>/application/controllers/AliasController.php.
Mô tả của NVD
Multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators to (1) add an administrator user via a crafted POST request to <vimbadmin directory>/application/controllers/DomainController.php, (2) remove an administrator user via a crafted GET request to <vimbadmin directory>/application/controllers/DomainController.php, (3) change an administrator password via a crafted POST request to <vimbadmin directory>/application/controllers/DomainController.php, (4) add a mailbox via a crafted POST request to <vimbadmin directory>/application/controllers/MailboxController.php, (5) delete a mailbox via a crafted POST request to <vimbadmin directory>/application/controllers/MailboxController.php, (6) archive a mailbox address via a crafted GET request to <vimbadmin directory>/application/controllers/ArchiveController.php, (7) add an alias address via a crafted POST request to <vimbadmin directory>/application/controllers/AliasController.php, or (8) remove an alias address via a crafted GET request to <vimbadmin directory>/application/controllers/AliasController.php.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí