🔍 CVE-2017-8928

8.8
CVSS Score
HIGH
2017-05-14
2026-06-17 01:27
✅ 완료

🇰🇷 한글 설명

mailcow 0.14 버전 및 dockerized 환경에서 발견된 CSRF(Cross-Site Request Forgery) 취약점입니다. 공격자가 악의적인 웹사이트 또는 이메일을 통해 사용자가 의도하지 않은 작업(사용자 생성, 설정 변경 등)을 mailcow 관리 인터페이스에서 수행하도록 유도할 수 있습니다. CSRF 토큰 검증이 부족하여 높은 심각도(CVSS 8.8)로 평가됩니다.

💡 쉬운 설명

A hacker can trick you into clicking a malicious link that makes unwanted changes to your mailcow email server without your knowledge. The vulnerability exists because the server doesn't properly verify that requests are coming from legitimate users.

🇺🇸 원문 (English)

mailcow 0.14, as used in "mailcow: dockerized" and other products, has CSRF.

📍 영향받는 시스템

mailcow 0.14, mailcow: dockerized and related products using vulnerable versions

⚔️ 공격 벡터

CSRF attack via crafted requests when authenticated user visits attacker-controlled webpage or email with malicious payload

🛡️ 대응 방법

Update mailcow to patched version, implement CSRF token validation in all state-changing operations, apply vendor security patches

🔧 검증 코드

If mailcow directory exists or container is running, cross-reference version from docker-compose.yml or container info against 0.14; if 0.14 is found, system is vulnerable and requires immediate update

Shell / Script 
ls -la /opt/mailcow-dockerized 2>/dev/null || docker ps -a 2>/dev/null | grep -i mailcow || echo 'mailcow not detected at standard paths'

📊 CVSS Vector String

CVSS Vector 
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

💻 영향받는 소프트웨어

Docker