CVE-2017-16651: Roundcube Webmail File Disclosure Vulnerability
In CISA’s Known Exploited Vulnerabilities catalog: Roundcube Webmail File Disclosure Vulnerability.
Added , federal remediation due . Known ransomware use: Unknown.
Required action: Apply updates per vendor instructions.
Description
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Status incidents that name it
No tracked status incident names this CVE.
Affected vendors and products
Roundcube: Roundcube Webmail
References
- CVE record on cve.org (opens in new tab)
- NVD entry (opens in new tab)
- packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html (opens in new tab)
- github.com/roundcube/roundcubemail/issues/6026 (opens in new tab)
- github.com/roundcube/roundcubemail/releases/tag/1.1.10 (opens in new tab)
- github.com/roundcube/roundcubemail/releases/tag/1.2.7 (opens in new tab)
- github.com/roundcube/roundcubemail/releases/tag/1.3.3 (opens in new tab)
- lists.debian.org/debian-lts-announce/2017/11/msg00039.html (opens in new tab)
- roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10 (opens in new tab)
- www.debian.org/security/2017/dsa-4030 (opens in new tab)
- www.securityfocus.com/bid/101793 (opens in new tab)
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)