high8.8Public exploit code
CVE-2018-6563
Multiple cross-site request forgery (CSRF) vulnerabilities in totemomail Encryption Gateway before 6.0.0_Build_371 allow remote attackers to hijack the authent…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- totemomail Encryption Gateway 6.0.0 Build 371 - Cross-Site Request Forgery2018-05-16 · webapps · asp
Impact
Multiple cross-site request forgery (CSRF) vulnerabilities in totemomail Encryption Gateway before 6.0.0_Build_371 allow remote attackers to hijack the authentication of users for requests that (1) change user settings, (2) send emails, or (3) change contact information by leveraging lack of an anti-CSRF token.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Totemo | Encryption Gateway | through 6.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/147648/Totemomail-Encryption-Gateway-6.0.0_Build_371-Cross-Site-Request-Forgery.html
- http://www.securityfocus.com/archive/1/542015/100/0/threaded
- https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-003_totemo_csrf.txt
- https://www.exploit-db.com/exploits/44631/
- http://packetstormsecurity.com/files/147648/Totemomail-Encryption-Gateway-6.0.0_Build_371-Cross-Site-Request-Forgery.html
- http://www.securityfocus.com/archive/1/542015/100/0/threaded
- https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-003_totemo_csrf.txt
- https://www.exploit-db.com/exploits/44631/