7.8

CVE-2017-16651

Warnung
Exploit
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Roundcube ≫ Webmail Version <= 1.1.9
Roundcube ≫ Webmail Version1.2.0
Roundcube ≫ Webmail Version1.2.1
Roundcube ≫ Webmail Version1.2.2
Roundcube ≫ Webmail Version1.2.3
Roundcube ≫ Webmail Version1.2.4
Roundcube ≫ Webmail Version1.2.5
Roundcube ≫ Webmail Version1.2.6
Roundcube ≫ Webmail Version1.3.0
Roundcube ≫ Webmail Version1.3.1
Roundcube ≫ Webmail Version1.3.2
Debian ≫ Debian Linux Version7.0
Debian ≫ Debian Linux Version9.0

03.11.2021: CISA Known Exploited Vulnerabilities (KEV) Catalog

Roundcube Webmail File Disclosure Vulnerability

Schwachstelle

Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 42.83% 0.985
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 4.6 3.9 6.4
AV:L/AC:L/Au:N/C:P/I:P/A:P
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-552 Files or Directories Accessible to External Parties

The product makes files or directories accessible to unauthorized actors, even though they should not be.

http://packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html
Third Party Advisory
Exploit
VDB Entry
http://www.securityfocus.com/bid/101793
Third Party Advisory
VDB Entry
https://github.com/roundcube/roundcubemail/issues/6026
Patch
Third Party Advisory
Issue Tracking
https://github.com/roundcube/roundcubemail/releases/tag/1.1.10
Third Party Advisory
Release Notes
Issue Tracking
https://github.com/roundcube/roundcubemail/releases/tag/1.2.7
Third Party Advisory
Release Notes
Issue Tracking
https://github.com/roundcube/roundcubemail/releases/tag/1.3.3
Third Party Advisory
Release Notes
Issue Tracking
https://lists.debian.org/debian-lts-announce/2017/11/msg00039.html
Third Party Advisory
Mailing List
https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10
Vendor Advisory
Issue Tracking
https://www.debian.org/security/2017/dsa-4030
Third Party Advisory
Issue Tracking
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-16651
US Government Resource