GitHub Advisoryadvisory · Packagist

GHSA-rrmf-fpmm-jpwr ViMbAdmin CSRF Vulnerabilities

HIGH Published 2022-05-17 Modified 2024-04-25 Official page ↗
Aliases
CVE-2017-6086
Ecosystem
Packagist
Packages
opensolutions/vimbadmin
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2024-04-25

Affected packages

• Packagist opensolutions/vimbadmin: <= 3.0.15 (no fix yet)

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators to 1. add an administrator user via a crafted POST request to `/application/controllers/DomainController.php`, 2. remove an administrator user via a crafted GET request to `/application/controllers/DomainController.php`, 3. change an administrator password via a crafted POST request to `/application/controllers/DomainController.php`, 4. add a mailbox via a crafted POST request to `/application/controllers/MailboxController.php`, 5. delete a mailbox via a crafted POST request to `/application/controllers/MailboxController.php`, 6. archive a mailbox address via a crafted GET request to `/application/controllers/ArchiveController.php`, 7. add an alias address via a crafted POST request to `/application/controllers/AliasController.php`, or 8. remove an alias address via a crafted GET request to `/application/controllers/AliasController.php`.

Related

Alias · CVE (1)

  • CVE-2017-6086 Multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References