CVE-2018-6563 describes multiple Cross-Site Request Forgery (CSRF) vulnerabilities affecting totemomail Encryption Gateway versions prior to 6.0.0_Build_371. These flaws stem from the absence of anti-CSRF tokens, allowing attackers to hijack user authentication. With a CVSS score of 8.8 (HIGH), the vulnerability is easily exploitable over the network with low complexity, potentially leading to high impact on confidentiality, integrity, and availability. Attackers could manipulate user settings, send emails, or alter contact information. While not actively exploited in the wild and lacking Metasploit or Nuclei modules, a public exploit (EDB-44631) exists, though community discussion and media coverage are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 6.0.0CPE matchmatch criteria | cpe:2.3:a:totemo:encryption_gateway:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
Remediation records are not available for this CVE.