CVE-2017-5930
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins...
CVE-2017-5930 is a low vulnerability (CVSS 2.7) in Postfixadmin Project Postfixadmin, published March 20, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 15.0%, the 96th percentile. Fixed in postfixadmin 2.9.2-r1.
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.
- Record
CVE-2017-5930- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
CVE List No score
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.
- Record
CVE-2017-5930- Updated
- 2026-11-02
EUVDEUVD-2017-15004 No score
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.
- Record
EUVD-2017-15004- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xgfq-m22c-vpjj
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins...
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.
- Record
GHSA-xgfq-m22c-vpjj- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVALPINE-CVE-2017-5930
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.
- Record
ALPINE-CVE-2017-5930- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSV
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.
- Record
CVE-2017-5930- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-5930
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.
- Record
DEBIAN-CVE-2017-5930- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-5930
The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.
- Record
UBUNTU-CVE-2017-5930- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11182-1 No score
postfixadmin-3.3.10-1.6 on GA media
These are all security issues fixed in the postfixadmin-3.3.10-1.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11182-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
postfixadminAlpine:v3.2 |
before 2.9.2-r1 | 2.9.2-r1 |
postfixadminAlpine:v3.3 |
before 3.0.2-r0 | 3.0.2-r0 |
postfixadminAlpine:v3.4 |
before 3.0.2-r0 | 3.0.2-r0 |
postfixadminAlpine:v3.5 |
before 3.0.2-r0 | 3.0.2-r0 |
postfixadminDebian:12 |
before 3.0.2-1 | 3.0.2-1 |
postfixadminDebian:13 |
before 3.0.2-1 | 3.0.2-1 |
postfixadminDebian:14 |
before 3.0.2-1 | 3.0.2-1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Postfixadmin Protected Alias Deletion Vulnerability | 2017-02-03 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, Metasploit, NVD, OSV |
References
sourceforge.net/p/postfixadmin/mailman/message/35646827
github.com/postfixadmin/postfixadmin/blob/postfixadmin-3.0.2/CHANGELOG.TXT
securityfocus.com/bid/96142
lists.opensuse.org/opensuse-updates/2017-02/msg00076.html
openwall.com/lists/oss-security/2017/02/08/1
Show 9 moreShow less
nvd.nist.gov/vuln/detail/CVE-2017-5930
security.alpinelinux.org/vuln/CVE-2017-5930
security-tracker.debian.org/tracker/CVE-2017-5930
ubuntu.com/security/CVE-2017-5930
cve.org/CVERecord?id=CVE-2017-5930
suse.com/security/cve/CVE-2017-5930