CVEvulnerability
CVE-2018-6563
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-06-20
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-352
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in totemomail Encryption Gateway before 6.0.0_Build_371 allow remote attackers to hijack the authentication of users for requests that (1) change user settings, (2) send emails, or (3) change contact information by leveraging lack of an anti-CSRF token.
Affected configurations
• totemo encryption gateway (<= 6.0.0)
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- http://packetstormsecurity.com/files/147648/Totemomail-Encryption-Gateway-6.0.0_Build_371-Cross-Site-Request-Forgery.html Exploit, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/542015/100/0/threaded www.securityfocus.com
- https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-003_totemo_csrf.txt Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/44631/ Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/147648/Totemomail-Encryption-Gateway-6.0.0_Build_371-Cross-Site-Request-Forgery.html Exploit, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/542015/100/0/threaded www.securityfocus.com
- https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-003_totemo_csrf.txt Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/44631/ Exploit, Third Party Advisory, VDB Entry