CVE-2017-5930 The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission che...
LowCVSS 2.7
EPSS 15.0%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/postfixadmin(Debian:12) | < 3.0.2-1 | 3.0.2-1 |
| debian/postfixadmin(Debian:13) | < 3.0.2-1 | 3.0.2-1 |
| debian/postfixadmin(Debian:14) | < 3.0.2-1 | 3.0.2-1 |
| openSUSE leap | = 42.1 | No fix listed |
| openSUSE leap | = 42.2 | No fix listed |
| postfixadmin project postfixadmin | < 3.0.2 | 3.0.2 |
| alpine/postfixadmin(Alpine:v3.10) | < 3.0.2-r0 | 3.0.2-r0 |
| alpine/postfixadmin(Alpine:v3.11) | < 3.0.2-r0 | 3.0.2-r0 |
| alpine/postfixadmin(Alpine:v3.12) | < 3.0.2-r0 | 3.0.2-r0 |
| alpine/postfixadmin(Alpine:v3.13) | < 3.0.2-r0 | 3.0.2-r0 |
| alpine/postfixadmin(Alpine:v3.14) | < 3.0.2-r0 | 3.0.2-r0 |
| alpine/postfixadmin(Alpine:v3.15) | < 3.0.2-r0 | 3.0.2-r0 |
| alpine/postfixadmin(Alpine:v3.16) | < 3.0.2-r0 | 3.0.2-r0 |
| alpine/postfixadmin(Alpine:v3.17) | < 3.0.2-r0 | 3.0.2-r0 |
| alpine/postfixadmin(Alpine:v3.18) | < 3.0.2-r0 | 3.0.2-r0 |
| alpine/postfixadmin(Alpine:v3.19) | < 3.0.2-r0 | 3.0.2-r0 |
| alpine/postfixadmin(Alpine:v3.2) | < 2.9.2-r1 | 2.9.2-r1 |
| alpine/postfixadmin(Alpine:v3.20) | < 3.0.2-r0 | 3.0.2-r0 |
| alpine/postfixadmin(Alpine:v3.21) | < 3.0.2-r0 | 3.0.2-r0 |
| alpine/postfixadmin(Alpine:v3.22) | < 3.0.2-r0 | 3.0.2-r0 |
| alpine/postfixadmin(Alpine:v3.23) | < 3.0.2-r0 | 3.0.2-r0 |
| alpine/postfixadmin(Alpine:v3.24) | < 3.0.2-r0 | 3.0.2-r0 |
| alpine/postfixadmin(Alpine:v3.3) | < 3.0.2-r0 | 3.0.2-r0 |
| alpine/postfixadmin(Alpine:v3.4) | < 3.0.2-r0 | 3.0.2-r0 |
| alpine/postfixadmin(Alpine:v3.5) | < 3.0.2-r0 | 3.0.2-r0 |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/postfixadmin(Alpine:v3.6) | < 3.0.2-r0 | 3.0.2-r0 |
| alpine/postfixadmin(Alpine:v3.7) | < 3.0.2-r0 | 3.0.2-r0 |
| alpine/postfixadmin(Alpine:v3.8) | < 3.0.2-r0 | 3.0.2-r0 |
| alpine/postfixadmin(Alpine:v3.9) | < 3.0.2-r0 | 3.0.2-r0 |
References
- Debian Security Tracker CVE-2017-5930 vendor-advisory
- bugs.debian.org issue-tracking
- openSUSE-SU-2017:0488 third-party-advisory vendor-advisory
- [oss-security] 20170207 Re: CVE request: PostfixAdmin allows to delete protected aliases mailing-list third-party-advisory
- [oss-security] 20170209 Re: CVE request: PostfixAdmin allows to delete protected aliases mailing-list third-party-advisory
- 96142 third-party-advisory vdb-entry vendor-advisory
- github.com release-notes third-party-advisory
- github.com patch third-party-advisory
- [postfixadmin-devel] 20170204 Security hole in AliasHandler mailing-list patch third-party-advisory
- security.alpinelinux.org vendor-advisory