Main
Vulnerability Database
Exploits
ID:3689 - Exploit for Missing Authorization in postfixadmin - CVE-2017-5930
ID:3689 - Exploit for Missing Authorization in postfixadmin - CVE-2017-5930
Published: August 4, 2020
Vulnerability identifier: #VU32995
Vulnerability risk: Low
CVE-ID: CVE-2017-5930
CWE-ID: CWE-862
Exploitation vector: Remote access
Vulnerable software:
postfixadmin
postfixadmin
Link to public exploit:
Vulnerability description
The vulnerability allows a remote user to bypass authorization process.
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.
Remediation
Install updates from vendor's website.