CVE-2021-44026criticalunder attackCWE-89

CVE-2021-44026

Published · Updated

Follow this CVE+ Monitor Webmail+ Monitor roundcube

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

90Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 9.8epss 70%
from disclosure to weapon725 days
Published on NVDNov 19
1st PoC+725d
CISA KEV+580d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
1 product — because the vulnerable code is not present in the product
red_hat_products
Action required by CISAfederal deadline: 2023-07-13

Apply updates per vendor instructions.

In short

Roundcube webmail versions before 1.3.17 and 1.4.12 have a flaw in the search feature that allows attackers to inject malicious SQL commands. This could let an attacker steal emails, passwords, or other sensitive data from the mail server.

Technical detail

SQL injection vulnerability in Roundcube's search and search_params functionality allows unauthenticated or authenticated attackers to execute arbitrary SQL queries against the backend database. The attack vector leverages improper input sanitization in search parameters, potentially leading to data exfiltration, authentication bypass, or database manipulation.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.