← back
CVE-2017-8114

CVE-2017-8114

EPSS 3.5%
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
Affected products
n/a · n/a

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11https://security.gentoo.org/glsa/201707-11http://www.securityfocus.com/bid/98445