CVE-2017-8114

Publicada em 29 abr 2017 · Atualizada em 05 ago 2024

Seguir esta CVE + Monitorar roundcube + Monitorar roundcubemail

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 3.5%

Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.

Produtos afetados

n/a · n/a

Referências

https://github.com/ilsani/rd/tree/master/security-advisories/web/roundcube/cve-2017-8114 https://roundcube.net/news/2017/04/28/security-updates-1.2.5-1.1.9-and-1.0.11 https://security.gentoo.org/glsa/201707-11 http://www.securityfocus.com/bid/98445