3.5

CVE-2017-5930

The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Opensuse ≫ Leap Version42.1
Opensuse ≫ Leap Version42.2
Postfixadmin Project ≫ Postfixadmin Version < 3.0.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 14.95% 0.963
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 2.7 1.2 1.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
nvd@nist.gov 3.5 6.8 2.9
AV:N/AC:M/Au:S/C:N/I:P/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

http://lists.opensuse.org/opensuse-updates/2017-02/msg00076.html
Third Party Advisory
http://www.openwall.com/lists/oss-security/2017/02/08/1
Third Party Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2017/02/09/1
Third Party Advisory
Mailing List
http://www.securityfocus.com/bid/96142
Third Party Advisory
Vendor Advisory
VDB Entry
https://github.com/postfixadmin/postfixadmin/blob/postfixadmin-3.0.2/CHANGELOG.TXT
Third Party Advisory
Release Notes
https://github.com/postfixadmin/postfixadmin/pull/23
Patch
Third Party Advisory
https://sourceforge.net/p/postfixadmin/mailman/message/35646827/
Patch
Third Party Advisory