| Vulnerability Name: | CVE-2017-5930 (CCN-123502) | ||||||||||||||||||||||||||||||||||||||||||||||||
| Assigned: | 2017-03-20 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Published: | 2017-03-20 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Updated: | 2020-02-26 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Summary: | The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check. | ||||||||||||||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 2.7 Low (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) 2.5 Low (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N/E:F/RL:O/RC:C)
4.0 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:F/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 3.5 Low (CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
| ||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-862 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||||||||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2017-5930 Source: SUSE Type: Third Party Advisory openSUSE-SU-2017:0488 Source: CCN Type: oss-sec Mailing List, Tue, 7 Feb 2017 20:12:24 -0500 Re: CVE request: PostfixAdmin allows to delete protected aliases Source: MLIST Type: Mailing List, Third Party Advisory [oss-security] 20170207 Re: CVE request: PostfixAdmin allows to delete protected aliases Source: MLIST Type: Mailing List, Third Party Advisory [oss-security] 20170209 Re: CVE request: PostfixAdmin allows to delete protected aliases Source: BID Type: Third Party Advisory, VDB Entry, Vendor Advisory 96142 Source: CCN Type: BID-96142 PostfixAdmin CVE-2017-5930 Session Management Security Bypass Vulnerability Source: XF Type: UNKNOWN postfixadmin-cve20175930-sec-bypass(123502) Source: CONFIRM Type: Release Notes, Third Party Advisory https://github.com/postfixadmin/postfixadmin/blob/postfixadmin-3.0.2/CHANGELOG.TXT Source: CCN Type: PostfixAdmin GIT Repository Fix security hole in AliasHandler #23 Source: CONFIRM Type: Patch, Third Party Advisory https://github.com/postfixadmin/postfixadmin/pull/23 Source: MLIST Type: Patch, Third Party Advisory [postfixadmin-devel] 20170204 Security hole in AliasHandler | ||||||||||||||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||||||||||||||