CVE-2017-16651
HighActively exploited (CISA KEV)
Description
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
SeverityHigh
CVSS7.8
Exploit probability—
Product
Roundcube Webmail
PublishedNov 9, 2017
First seenNov 9, 2017
Added to KEVNov 3, 2021
Weakness typeCWE-552CWE-552
How to fix
CISA required action
Apply updates per vendor instructions.
CISA due date: May 3, 2022Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| roundcube webmail | v ≤ 1.1.9, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.3.0, 1.3.1, 1.3.2 | — |
| debian debian_linux | 7.0, 9.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.