CVE-2018-6563

HIGH

Totemo Encryption Gateway < 6.0.0 - CSRF

Title source: rule

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in totemomail Encryption Gateway before 6.0.0_Build_371 allow remote attackers to hijack the authentication of users for requests that (1) change user settings, (2) send emails, or (3) change contact information by leveraging lack of an anti-CSRF token.

Exploits (1)

exploitdb WORKING POC

by Compass Security · htmlwebappsasp

https://www.exploit-db.com/exploits/44631

View Code ZIP pw:eip

References (4)

[Exploit, Third Party Advisory, VDB Entry] http://packetstormsecurity.com/files/147648/Totemomail-Encryption-Gateway-6.0.0_Build_371-Cross-Site-Request-Forgery.html

[Exploit, Third Party Advisory] https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-003_totemo_csrf.txt

[Exploit, Third Party Advisory, VDB Entry] https://www.exploit-db.com/exploits/44631/

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/542015/100/0/threaded

Scores

CVSS v3 8.8

EPSS 0.0010

EPSS Percentile 27.4%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-352

Status published

Products (1)

totemo/encryption_gateway < 6.0.0

Published Jun 20, 2018

Tracked Since Feb 18, 2026