CVE-2020-12641
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
Roundcube Webmail versions before 1.4.4 allow attackers to run malicious code by injecting shell commands through image conversion settings. This is critical because the vulnerable settings are often controlled or influenced by administrators, giving attackers a direct path to execute arbitrary commands on the server.
CWE-78 command injection vulnerability in rcube_image.php exploits unsanitized shell metacharacters in the im_convert_path or im_identify_path configuration parameters. An attacker with ability to modify these settings or influence their values can inject arbitrary shell commands that execute with the privileges of the web server process, leading to complete system compromise.
The full analysis of this CVE is available in Portuguese →