← volver
CVE-2017-8114

CVE-2017-8114

EPSS 3.5%
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
Productos afectados
n/a · n/a

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →
Referencias
https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11https://security.gentoo.org/glsa/201707-11http://www.securityfocus.com/bid/98445