CVE-2017-16651: Roundcube Webmail File Disclosure Vulnerability
First published: Thu Nov 09 2017(Updated: )
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Roundcube Webmail | <=1.1.9 | |
| Roundcube Webmail | =1.2.0 | |
| Roundcube Webmail | =1.2.1 | |
| Roundcube Webmail | =1.2.2 | |
| Roundcube Webmail | =1.2.3 | |
| Roundcube Webmail | =1.2.4 | |
| Roundcube Webmail | =1.2.5 | |
| Roundcube Webmail | =1.2.6 | |
| Roundcube Webmail | =1.3.0 | |
| Roundcube Webmail | =1.3.1 | |
| Roundcube Webmail | =1.3.2 | |
| Debian Debian Linux | =7.0 | |
| Debian Debian Linux | =9.0 | |
| debian/roundcube | 1.3.17+dfsg.1-1~deb10u2 1.3.17+dfsg.1-1~deb10u3 1.4.14+dfsg.1-1~deb11u1 1.4.13+dfsg.1-1~deb11u1 1.6.3+dfsg-1~deb12u1 1.6.4+dfsg-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html
- http://www.securityfocus.com/bid/101793
- https://github.com/roundcube/roundcubemail/issues/6026
- https://github.com/roundcube/roundcubemail/releases/tag/1.1.10
- https://github.com/roundcube/roundcubemail/releases/tag/1.2.7
- https://github.com/roundcube/roundcubemail/releases/tag/1.3.3
- https://lists.debian.org/debian-lts-announce/2017/11/msg00039.html
- https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10
- https://www.debian.org/security/2017/dsa-4030
- https://github.com/roundcube/roundcubemail/commit/2a32f51c91d5e9c7b1a9d931846dd44c008ff36d
- https://github.com/roundcube/roundcubemail/commit/c90ad5a97784fb32683b8e3c21d6c95baab6d806
- https://github.com/roundcube/roundcubemail/commit/9be2224c779d7abc7b29eea2b83a8a3671c543e0
- https://github.com/roundcube/roundcubemail/commit/e757cc410145d043c30889d28fa0b5f67a5cf2fd
- https://github.com/roundcube/roundcubemail/commit/8d87bb34f3c6103ab81e5342d8b3d297832d178a
- https://security-tracker.debian.org/tracker/CVE-2017-16651
- https://nvd.nist.gov/vuln/detail/CVE-2017-16651
Frequently Asked Questions
What is the vulnerability ID for the Roundcube Webmail file disclosure vulnerability?
The vulnerability ID for the Roundcube Webmail file disclosure vulnerability is CVE-2017-16651.
What is the severity of CVE-2017-16651?
The severity of CVE-2017-16651 is high with a CVSS score of 7.8.
Which versions of Roundcube Webmail are affected by CVE-2017-16651?
Roundcube Webmail versions before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 are affected by CVE-2017-16651.
How can an attacker exploit CVE-2017-16651?
An attacker can exploit CVE-2017-16651 by gaining unauthorized access to arbitrary files on the host's filesystem, including configuration files.
Is there a fix available for CVE-2017-16651?
Yes, a fix for CVE-2017-16651 is available. Users should update to Roundcube Webmail version 1.1.10, 1.2.7, or 1.3.3 or later.
- collector/nvd-index
- collector/security-tracker-debian
- agent/type
- agent/softwarecombine
- agent/title
- agent/remedy
- agent/weakness
- agent/author
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/references
- agent/tags
- collector/nvd-cve
- source/NVD
- vendor/roundcube
- canonical/roundcube webmail
- version/roundcube webmail/1.1.9
- version/roundcube webmail/1.2.0
- version/roundcube webmail/1.2.1
- version/roundcube webmail/1.2.2
- version/roundcube webmail/1.2.3
- version/roundcube webmail/1.2.4
- version/roundcube webmail/1.2.5
- version/roundcube webmail/1.2.6
- version/roundcube webmail/1.3.0
- version/roundcube webmail/1.3.1
- version/roundcube webmail/1.3.2
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/7.0
- version/debian debian linux/9.0
- package-manager/debian
- canonical/roundcube roundcube webmail