Roundcube · Roundcube Webmail
CVE-2017-16651
Roundcube Webmail File Disclosure Vulnerability
Nedir
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
CISA: Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.
Ne yapmalı
Apply updates per vendor instructions.
ABD federal kurumları için son tarih: 3 Mayıs 2022
- CISA listesine eklenme
- 3 Kasım 2021
- Yayımlanma
- 9 Kasım 2017
- Önem
- Yüksek 7,8 CVSS 3.1
- Önümüzdeki 30 günde saldırı olasılığı (EPSS)
- 46% bilinen tüm açıkların en üstteki 1,2% diliminde
- Zayıflık
- CWE-552
- Daha fazla ayrıntı
- NVD · CVE.org · CISA
Tüm kaynaklar (9)
- https://www.debian.org/security/2017/dsa-4030
- https://github.com/roundcube/roundcubemail/releases/tag/1.3.3
- https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10
- https://lists.debian.org/debian-lts-announce/2017/11/msg00039.html
- https://github.com/roundcube/roundcubemail/releases/tag/1.1.10
- http://www.securityfocus.com/bid/101793
- https://github.com/roundcube/roundcubemail/releases/tag/1.2.7
- https://github.com/roundcube/roundcubemail/issues/6026
- http://packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html
Roundcube için istismar edilen diğer açıklar
| Eklenme | Açık | Ürün | Önem | Saldırı olasılığı |
|---|---|---|---|---|
| 22 Haz 2023 | Webmail Remote Code Execution | Roundcube Webmail | Kritik 9,8 | 84% |
| 22 Haz 2023 | Webmail Cross-Site Scripting (XSS) | Roundcube Webmail | Orta 6,1 | 33% |
| 22 Haz 2023 | Webmail SQL Injection | Roundcube Webmail | Kritik 9,8 | 70% |
| 20 Şub 2026 | Deserialization of Untrusted Data | Webmail | Kritik 9,9 | 99,7% |
| 20 Şub 2026 | Cross-site Scripting | Webmail | Yüksek 7,2 | 27% |
| 9 Haz 2025 | Cross-Site Scripting | Webmail | Kritik 9,3 | 83% |
| 24 Eki 2024 | Cross-Site Scripting (XSS) | Webmail | Orta 6,1 | 74% |
| 26 Haz 2024 | Cross-Site Scripting (XSS) | Webmail | Orta 6,3 | 77% |
Kaynaklar: Known Exploited Vulnerabilities (CISA, kamu malı), CVE records (cve.org) ve EPSS (FIRST). Saldırı olasılığı, birinin önümüzdeki 30 günde açığı istismar etmeye çalışacağına dair EPSS tahminidir.