The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.
CVSS Details
- CVSS 3.1 Base Score: 2.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postfixadmin | Aug 30, 2017 | Mar 20, 2017 |
| Debian | — | Upgrade postfixadmin | Jul 30, 2024 | Mar 20, 2017 |
| Suse | — | Upgrade postfixadmin | Feb 17, 2017 | Feb 17, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub