What is CVE-2017-6086?

CVE-2017-6086 is a high-severity vulnerability in Vimbadmin, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2017-06-27.

How severe is CVE-2017-6086?

High severity. CVSS v3 base score is 8.8 out of 10.

CSRF in Vimbadmin

CVE-2017-6086

Multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attackers to hijack the authentication of logged administrators to (1) add an administrator user via a crafted POST request to <vimbadmin directory>/application/controllers/DomainController.php, (2) remove an administrator user via a crafted GET request to <vimbadmin directory>/application/controllers/DomainController.php, (3) change an administrator password via a crafted POST request to <vimbadmin directory>/application/controllers/DomainController.php, (4) add a mailbox via a crafted POST request to <vimbadmin directory>/application/controllers/MailboxController.php, (5) delete a mailbox via a crafted POST request to <vimbadmin directory>/application/controllers/MailboxController.php, (6) archive a mailbox address via a crafted GET request to <vimbadmin directory>/application/controllers/ArchiveController.php, (7) add an alias address via a crafted POST request to <vimbadmin directory>/application/controllers/AliasController.php, or (8) remove an alias address via a crafted GET request to <vimbadmin directory>/application/controllers/AliasController.php.

Vulnerability class: CSRF (Cross-Site Request Forgery)

Published 2017-06-27 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.020 (80.0th percentile), scored 2026-10-07.

Low probability of exploitation in the next 30 days, but still tracked. 80th percentile — 80.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.020 · newest: 0.020 · change: 0.000

Affected products

Vimbadmin — versions 3.0.15

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

www.exploit-db.com/exploits/41967/ (exploit)
www.openwall.com/lists/oss-security/2017/05/03/7 (mailing-list, Exploit, Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2017-6086?: CVE-2017-6086 is a high-severity vulnerability in Vimbadmin, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2017-06-27.
How severe is CVE-2017-6086?: High severity. CVSS v3 base score is 8.8 out of 10.