CVE-2017-6086 json
ViMbAdmin CSRF Vulnerabilities
published 2017-06-27 9 y ago modified 2026-06-17 4 mo ago also GHSA-rrmf-fpmm-jpwr , EUVD-2022-5229
- cvss
- 8.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.0%
- EPSS 2.0% chance of exploitation in 30 days, percentile 80%
- public exploits
- 1
- Exploit-DB
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators to (1) add an administrator user via a crafted POST request to <vimbadmin directory>/application/controllers/DomainController.php, (2) remove an administrator user via a crafted GET request to <vimbadmin directory>/application/controllers/DomainController.php, (3) change an administrator password via a crafted POST request to <vimbadmin directory>/application/controllers/DomainController.php, (4) add a mailbox via a crafted POST request to <vimbadmin directory>/application/controllers/MailboxController.php, (5) delete a mailbox via a crafted POST request to <vimbadmin directory>/application/controllers/MailboxController.php, (6) archive a mailbox address via a crafted GET request to <vimbadmin directory>/application/controllers/ArchiveController.php, (7) add an alias address via a crafted POST request to <vimbadmin directory>/application/controllers/AliasController.php, or (8) remove an alias address via a crafted GET request to <vimbadmin directory>/application/controllers/AliasController.php.
Timeline
- First public exploit (EDB-41967)
- Published
Exploit prediction
2.00% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-41967 ViMbAdmin 3.0.15 - Multiple Cross-Site Request Forgery Vulnerabilities webapps, 2017-05-05
- openwall.com http://www.openwall.com/lists/oss-security/2017/05/03/7 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | opensolutions/vimbadmin | <=3.0.15 |
no fix listed |
Classification
- Weakness
-
- CWE-352 Cross-Site Request Forgery
References
-
exploit-db.com
/exploits/41967/
exploit
-
openwall.com
/lists/oss-security/2017/05/03/7
mailing-list, web, exploit, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2017-6086
advisory
-
github.com
/opensolutions/ViMbAdmin/issues/250
web
-
github.com
/opensolutions/ViMbAdmin
package
-
exploit-db.com
/exploits/41967
web
Sources
- CVE List CVE-2017-6086
- GitHub Advisory GHSA-rrmf-fpmm-jpwr
- NVD CVE-2017-6086
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.