Roundcube · Roundcube Webmail
CVE-2017-16651
Roundcube Webmail File Disclosure Vulnerability
무엇인가
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
CISA: Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.
할 일
Apply updates per vendor instructions.
미국 연방 기관 조치 기한: 2022년 5월 3일
- CISA 목록에 추가됨
- 2021년 11월 3일
- 게시됨
- 2017년 11월 9일
- 심각도
- 높음 7.8 CVSS 3.1
- 향후 30일 내 공격 가능성(EPSS)
- 46% 알려진 모든 취약점 중 상위 1.2%
- 약점 유형
- CWE-552
- 자세히
- NVD · CVE.org · CISA
모든 참고 자료(9)
- https://www.debian.org/security/2017/dsa-4030
- https://github.com/roundcube/roundcubemail/releases/tag/1.3.3
- https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10
- https://lists.debian.org/debian-lts-announce/2017/11/msg00039.html
- https://github.com/roundcube/roundcubemail/releases/tag/1.1.10
- http://www.securityfocus.com/bid/101793
- https://github.com/roundcube/roundcubemail/releases/tag/1.2.7
- https://github.com/roundcube/roundcubemail/issues/6026
- http://packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html
Roundcube의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2023. 6. 22. | Webmail Remote Code Execution | Roundcube Webmail | 치명적 9.8 | 84% |
| 2023. 6. 22. | Webmail Cross-Site Scripting (XSS) | Roundcube Webmail | 보통 6.1 | 33% |
| 2023. 6. 22. | Webmail SQL Injection | Roundcube Webmail | 치명적 9.8 | 70% |
| 2026. 2. 20. | Deserialization of Untrusted Data | Webmail | 치명적 9.9 | 99.7% |
| 2026. 2. 20. | Cross-site Scripting | Webmail | 높음 7.2 | 27% |
| 2025. 6. 9. | Cross-Site Scripting | Webmail | 치명적 9.3 | 83% |
| 2024. 10. 24. | Cross-Site Scripting (XSS) | Webmail | 보통 6.1 | 74% |
| 2024. 6. 26. | Cross-Site Scripting (XSS) | Webmail | 보통 6.3 | 77% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.