Roundcube · Roundcube Webmail · CVE-2017-8114
**Name of the Vulnerable Software and Affected Versions**
Roundcube Webmail versions prior to 1.0.11
Roundcube Webmail versions 1.1.x before 1.1.9
Roundcube Webmail versions 1.2.x before 1.2.5
**Description**
The issue allows arbitrary password resets by authenticated users due to an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
**Recommendations**
For versions prior to 1.0.11, update to version 1.0.11 or later.
For versions 1.1.x before 1.1.9, update to version 1.1.9 or later.
For versions 1.2.x before 1.2.5, update to version 1.2.5 or later.