Upstream information

CVE-2017-5930 at MITRE

Description

The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.

SUSE information

CVSS v2 Scores
  National Vulnerability Database
Base Score 3.47
Vector AV:N/AC:M/Au:S/C:N/I:P/A:N
Access Vector Network
Access Complexity Medium
Authentication Single
Confidentiality Impact None
Integrity Impact Partial
Availability Impact None
CVSS v3 Scores
  National Vulnerability Database
Base Score 2.7
Vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Access Vector Network
Access Complexity Low
Privileges Required High
User Interaction None
Scope Unchanged
Confidentiality Impact None
Integrity Impact Low
Availability Impact None
SUSE Bugzilla entry: 1024211 [RESOLVED / FIXED]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
openSUSE Leap 42.1
  • postfixadmin >= 3.0.2-5.1
Patchnames:
openSUSE-2017-261
openSUSE Leap 42.2
  • postfixadmin >= 3.0.2-3.1
Patchnames:
openSUSE-2017-261