{"id":"GHSA-rrmf-fpmm-jpwr","aliases":["CVE-2017-6086"],"title":"ViMbAdmin CSRF Vulnerabilities","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators to\n1. add an administrator user via a crafted POST request to `<vimbadmin directory>/application/controllers/DomainController.php`,\n2. remove an administrator user via a crafted GET request to `<vimbadmin directory>/application/controllers/DomainController.php`,\n3. change an administrator password via a crafted POST request to `<vimbadmin directory>/application/controllers/DomainController.php`,\n4. add a mailbox via a crafted POST request to `<vimbadmin directory>/application/controllers/MailboxController.php`,\n5. delete a mailbox via a crafted POST request to `<vimbadmin directory>/application/controllers/MailboxController.php`,\n6. archive a mailbox address via a crafted GET request to `<vimbadmin directory>/application/controllers/ArchiveController.php`,\n7. add an alias address via a crafted POST request to `<vimbadmin directory>/application/controllers/AliasController.php`, or\n8. remove an alias address via a crafted GET request to `<vimbadmin directory>/application/controllers/AliasController.php`.","severity":"high","score":8.8,"published":"2022-05-17T02:12:38.000Z","modified":"2024-04-25T23:11:46.018Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"opensolutions/vimbadmin","ranges":[{"events":[{"introduced":"0"},{"last_affected":"3.0.15"}],"type":"ECOSYSTEM"}],"versions":["3.0.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.14","3.0.15","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9"],"fixed":[]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2017-6086","https://github.com/opensolutions/ViMbAdmin/issues/250","https://github.com/opensolutions/ViMbAdmin","https://www.exploit-db.com/exploits/41967","http://www.openwall.com/lists/oss-security/2017/05/03/7"],"sources":[{"name":"OSV","id":"GHSA-rrmf-fpmm-jpwr","modified":"2024-04-25T23:11:46.018033Z","url":"https://osv.dev/vulnerability/GHSA-rrmf-fpmm-jpwr"}],"assessments":[{"source":"OSV","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8}]}