openSUSE-SU-2017:0488Vendor advisory
http://lists.opensuse.org/opensuse-updates/2017-02/msg00076.html CVE-2017-5930
LOW
opensuse leap Missing Authorization
Record summary
CVE-2017-5930 has a selected CVSS score of 2.7 (low); EIP currently links 1 catalogued exploit.
Description
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Jan 26, 2022 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
Available material
- Catalogued exploits
- 1
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
| VulnCheck | Version data not supplied | ||
Proofs of concept
1Catalogued exploits
MetasploitPostfixadmin Protected Alias Deletion VulnerabilityMetasploit auxiliary PoCby Jan-Frederik RieckersNot analyzed1 file
References
8[oss-security] 20170207 Re: CVE request: PostfixAdmin allows to delete protected aliasesmailing list
http://www.openwall.com/lists/oss-security/2017/02/08/1 [oss-security] 20170209 Re: CVE request: PostfixAdmin allows to delete protected aliasesmailing list
http://www.openwall.com/lists/oss-security/2017/02/09/1 96142vdb entry
http://www.securityfocus.com/bid/96142 github.comConfirmation
https://github.com/postfixadmin/postfixadmin/blob/postfixadmin-3.0.2/CHANGELOG.TXT github.comConfirmation
https://github.com/postfixadmin/postfixadmin/pull/23 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2017-5930 [postfixadmin-devel] 20170204 Security hole in AliasHandlermailing list
https://sourceforge.net/p/postfixadmin/mailman/message/35646827