NVD Vulnerability Detail

CVE-2017-6086

Summary	Multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators to (1) add an administrator user via a crafted POST request to <vimbadmin directory>/application/controllers/DomainController.php, (2) remove an administrator user via a crafted GET request to <vimbadmin directory>/application/controllers/DomainController.php, (3) change an administrator password via a crafted POST request to <vimbadmin directory>/application/controllers/DomainController.php, (4) add a mailbox via a crafted POST request to <vimbadmin directory>/application/controllers/MailboxController.php, (5) delete a mailbox via a crafted POST request to <vimbadmin directory>/application/controllers/MailboxController.php, (6) archive a mailbox address via a crafted GET request to <vimbadmin directory>/application/controllers/ArchiveController.php, (7) add an alias address via a crafted POST request to <vimbadmin directory>/application/controllers/AliasController.php, or (8) remove an alias address via a crafted GET request to <vimbadmin directory>/application/controllers/AliasController.php.
Publication Date	June 28, 2017, 5:29 a.m.
Registration Date	Jan. 26, 2021, 1:26 p.m.
Last Update	Nov. 21, 2024, 12:29 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:vimbadmin:vimbadmin:3.0.15:::::::*

Related information, measures and tools

No	URL	タグ
1	http://www.openwall.com/lists/oss-security/2017/05/03/7	Exploit Mailing List Third Party Advisory
2	http://www.openwall.com/lists/oss-security/2017/05/03/7	Exploit Mailing List Third Party Advisory
3	https://www.exploit-db.com/exploits/41967/
4	https://www.exploit-db.com/exploits/41967/

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-352	クロスサイト・リクエスト・フォージェリ（CSRF）	https://cwe.mitre.org/data/definitions/352.html
2	CWE-352	同一生成元ポリシー違反	https://cwe.mitre.org/data/definitions/346.html

JVN Vulnerability Information

ViMbAdmin におけるクロスサイトリクエストフォージェリの脆弱性

Title	ViMbAdmin におけるクロスサイトリクエストフォージェリの脆弱性
Summary	ViMbAdmin には、クロスサイトリクエストフォージェリの脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	May 3, 2017, midnight
Registration Date	July 25, 2017, 2:14 p.m.
Last Update	July 25, 2017, 2:14 p.m.

Affected System

ViMbAdmin

ViMbAdmin 3.0.15

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-6086	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6086
National Vulnerability Database (NVD)
2	CVE-2017-6086	https://nvd.nist.gov/vuln/detail/CVE-2017-6086

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-352	https://jvndb.jvn.jp/ja/cwe/CWE-352.html

ベンダー情報

No	Name	URL
ViMbAdmin
1	Top Page	https://www.vimbadmin.net/

その他

No	Name	URL
関連文書
1	Multiple CSRF vulnerabilities in ViMbAdmin version 3.0.15	http://www.openwall.com/lists/oss-security/2017/05/03/7

Change Log

No	Changed Details	Date of change
0	[2017年07月25日] 掲載	Feb. 17, 2018, 10:37 a.m.