Multiple cross-site request forgery (CSRF) vulnerabilities in totemomail Encryption Gateway before 6.0.0_Build_371 allow remote attackers t…

Published 8 y ago 2018-06-20 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

2.3%

percentile 83%

Public exploits

Exploit-DB

Multiple cross-site request forgery (CSRF) vulnerabilities in totemomail Encryption Gateway before 6.0.0_Build_371 allow remote attackers to hijack the authentication of users for requests that (1) change user settings, (2) send emails, or (3) change contact information by leveraging lack of an anti-CSRF token.

Exploit prediction (EPSS)

2.26% probability of exploitation in the next 30 days, higher than 83% of all scored CVEs.

Exploits and detections

EDB-44631 totemomail Encryption Gateway 6.0.0 Build 371 - Cross-Site Request Forgery · webapps · 2018-05-16

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	8.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
NVD	2.0	6.8	`AV:N/AC:M/Au:N/C:P/I:P/A:P`

Classification

Weakness

CWE-352 Cross-Site Request Forgery

References

packetstormsecurity.com /files/147648/Totemomail-Encryption-Gateway-6.0.0_Build_371-Cross-Site-Request-Forgery.htm · x_refsource_MISC, x_transferred
securityfocus.com /archive/1/542015/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
compass-security.com /fileadmin/Datein/Research/Advisories/CSNC-2018-003_totemo_csrf.txt · x_refsource_MISC, x_transferred
exploit-db.com /exploits/44631/ · exploit, x_refsource_EXPLOIT-DB, x_transferred

Sources

CVE List: CVE-2018-6563
NVD: CVE-2018-6563

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.