CVE-2017-6086

CVE-2017-6086 describes multiple Cross-Site Request Forgery (CSRF) vulnerabilities in ViMbAdmin 3.0.15, specifically within the addAction and purgeAction functions. These flaws allow remote attackers to hijack authenticated administrator sessions to perform various actions, including adding/removing administrators, changing passwords, and managing mailboxes or aliases. The vulnerability has a CVSSv3 score of 8.8 (HIGH), indicating a critical impact with high confidentiality, integrity, and availability compromise, requiring user interaction but with low attack complexity. While not listed on the KEV catalog and lacking active exploitation or significant community discussion, exploit code is publicly available via ExploitDB, suggesting a potential for future exploitation.